CVE-2023-32251
Low
Description
A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-force protection, potentially allowing attackers to conduct dictionary attacks more efficiently against user credentials or other authentication mechanisms.
SeverityLow
CVSS3.7
Exploit probability—
ProductLinux
PublishedJul 31, 2025
First seenJul 31, 2025
Weakness typeCWE-307CWE-307
How to fix
Update
- linux5.15.145, 6.0.*, 6.1.29, 6.2.16, 6.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux | v < 5.15.145, 6.0.0 ≤ v < 6.0.*, 6.1.0 ≤ v < 6.1.29, 6.2.0 ≤ v < 6.2.16, 6.3.0 ≤ v < 6.3.2 | 5.15.145, 6.0.*, 6.1.29, 6.2.16, 6.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.