CVE-2023-4458 is a medium severity (CVSS 4.0) out of bounds read in the Linux kernel ksmbd module, in the parsing of extended attributes. Only systems with ksmbd enabled are vulnerable. Check whether the module is loaded, and update to a kernel that includes the upstream fix.
What's affected
The NVD record describes a flaw in how the ksmbd kernel module parses extended attributes. The lack of validation of user supplied data can cause a read past the end of an allocated buffer, which can disclose sensitive information. Only systems with ksmbd enabled are vulnerable.
The Zero Day Initiative advisory ZDI-24-590, dated 10 June 2024, rates it 4.0 with a network vector and high attack complexity. It names the smb2_open path and notes that, depending on configuration, authentication may or may not be needed.
Red Hat states that no Red Hat products are affected, because the ksmbd code is not included in any shipped RHEL kernel release. That is a useful difference between sources. Distributions that do ship ksmbd, and custom kernels, may be affected, so check your own kernel build.
How to check if you're exposed
ksmbd is an in kernel SMB server. Most systems do not run it. Start by checking whether the module is present and loaded.
uname -r
lsmod | grep ksmbd
systemctl status ksmbd 2>/dev/null
If the module is not loaded and no service uses it, the condition in the record is not met on that host. Also check kernel configuration for the module being built in, and whether it can be autoloaded on demand.
For fixed versions, use your distribution kernel changelog, searching for the CVE id, since upstream version numbers differ by branch.
What to do now
- Find the hosts that run ksmbd, such as appliances and lightweight file servers that chose it over Samba.
- Update the kernel to a build that lists CVE-2023-4458 as fixed in the vendor changelog.
- If you do not need ksmbd, unload it and block it from loading.
- Limit SMB access to trusted networks, and do not expose it to the internet.
- Reboot into the new kernel and confirm with uname.
Why it matters
The weakness is CWE-125, an out of bounds read. The code trusts a length or offset from the client while parsing a request, and reads memory beyond the buffer. The impact is confidentiality only, which keeps the score in the medium band.
Even so, leaked kernel memory can contain information that helps with other attacks. Running fewer kernel services is the strongest control here. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
My distribution says it is not affected. Am I safe?
If the distribution does not ship ksmbd, as Red Hat states for RHEL, you are not exposed through its kernels. Custom or mainline kernels with ksmbd still need a check.
Sources
Last reviewed: 19 October 2026.
