CVE-2023-4130

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-4130
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4130.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-4130
Downstream
Related
Published
2025-08-16T13:27:58Z
Modified
2026-08-17T03:36:08Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()

There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to validate buffer length Before accessing the next ea. ksmbd should check buffer length using buf_len, not next variable. next is the start offset of current ea that got from previous ea.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4130.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Fixed
aeb974907642be095e38ecb1a400ca583958b2b0
Fixed
f339d76a3a972601d0738b881b099d49ebbdc3a2
Fixed
4bf629262f9118ee91b1c3a518ebf2b3bcb22180
Fixed
79ed288cef201f1f212dfb934bcaac75572fb8f6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4130.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
5.15.127
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.46
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.4.11

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4130.json"