Description
The smb_recv_trans2 function call in the samba filesystem (smbfs) in Linux kernel 2.4 and 2.6 does not properly handle the re-assembly of fragmented packets correctly, which could allow remote samba servers to (1) read arbitrary kernel information or (2) raise a counter value to an arbitrary number by sending the first part of the fragmented packet multiple times.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kernel-image-sparc-2.4 | 26woody1 | DSA-1070-1 |
| Debian 3.0 | kernel-patch-2.4.19-mips | 2.4.19-0.020911.1.woody5 | DSA-1070-1 |
| Debian 3.0 | kernel-source-2.4.16 | 2.4.16-1woody2 | DSA-1067-1 |
| Debian 3.0 | kernel-source-2.4.17 | 2.4.17-1woody4 | DSA-1082-1 |
| Debian 3.0 | kernel-source-2.4.18 | 2.4.18-14.4 | DSA-1069-1 |
| Debian 3.0 | kernel-source-2.4.19 | 2.4.19-4.woody3 | DSA-1070-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kernel +8 | 2.4.21-20.0.1.EL | RHSA-2004:549 |
Advisories 5
- RHSA-2004:549 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1082-1 kernel-source-2.4.17 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1067-1 kernel-source-2.4.16 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1069-1 kernel-source-2.4.18 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1070-1 kernel-source-2.4.19 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20163 third-party-advisory
- 11695 vdb-entry
- DSA-1082 vendor-advisory
- MDKSA-2005:022 vendor-advisory
- 20041117 Advisory 14/2004: Linux 2.x smbfs multiple remote vulnerabilities mailing-list
- FLSA:2336 vendor-advisory
- oval:org.mitre.oval:def:10360 vdb-entry signature
- USN-30-1 vendor-advisory
- http://security.e-matters.de/advisories/142004.html
- DSA-1070 vendor-advisory
- RHSA-2004:537 vendor-advisory
- 20162 third-party-advisory
- linux-smbrecvtrans2-memory-leak(18137) vdb-entry
- DSA-1067 vendor-advisory
- DSA-1069 vendor-advisory
- 2004-0061 vendor-advisory
- RHSA-2004:505 vendor-advisory
- 20202 third-party-advisory
- RHSA-2004:504 vendor-advisory
- 13232 third-party-advisory
- 20338 third-party-advisory