diff --git a/patches.kernel.org/6.2.12-103-ksmbd-avoid-out-of-bounds-access-in-decode_pre.patch b/patches.kernel.org/6.2.12-103-ksmbd-avoid-out-of-bounds-access-in-decode_pre.patch
new file mode 100644
index 0000000..2a1bec6
--- /dev/null
+++ b/patches.kernel.org/6.2.12-103-ksmbd-avoid-out-of-bounds-access-in-decode_pre.patch
@@ -0,0 +1,74 @@
+From: David Disseldorp <ddiss@suse.de>
+Date: Thu, 13 Apr 2023 23:49:57 +0900
+Subject: [PATCH] ksmbd: avoid out of bounds access in decode_preauth_ctxt()
+References: bsc#1012628
+Patch-mainline: 6.2.12
+Git-commit: e7067a446264a7514fa1cfaa4052cdb6803bc6a2
+
+commit e7067a446264a7514fa1cfaa4052cdb6803bc6a2 upstream.
+
+Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within
+the SMB request boundary; deassemble_neg_contexts() only checks that the
+eight byte smb2_neg_context header + (client controlled) DataLength are
+within the packet boundary, which is insufficient.
+
+Checking for sizeof(struct smb2_preauth_neg_context) is overkill given
+that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.
+
+Signed-off-by: David Disseldorp <ddiss@suse.de>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/ksmbd/smb2pdu.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
+index 7e0b62f9..32a83701 100644
+--- a/fs/ksmbd/smb2pdu.c
++++ b/fs/ksmbd/smb2pdu.c
+@@ -872,17 +872,21 @@ static void assemble_neg_contexts(struct ksmbd_conn *conn,
+ }
+ 
+ static __le32 decode_preauth_ctxt(struct ksmbd_conn *conn,
+-				  struct smb2_preauth_neg_context *pneg_ctxt)
++				  struct smb2_preauth_neg_context *pneg_ctxt,
++				  int len_of_ctxts)
+ {
+-	__le32 err = STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP;
++	/*
++	 * sizeof(smb2_preauth_neg_context) assumes SMB311_SALT_SIZE Salt,
++	 * which may not be present. Only check for used HashAlgorithms[1].
++	 */
++	if (len_of_ctxts < MIN_PREAUTH_CTXT_DATA_LEN)
++		return STATUS_INVALID_PARAMETER;
+ 
+-	if (pneg_ctxt->HashAlgorithms == SMB2_PREAUTH_INTEGRITY_SHA512) {
+-		conn->preauth_info->Preauth_HashId =
+-			SMB2_PREAUTH_INTEGRITY_SHA512;
+-		err = STATUS_SUCCESS;
+-	}
++	if (pneg_ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512)
++		return STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP;
+ 
+-	return err;
++	conn->preauth_info->Preauth_HashId = SMB2_PREAUTH_INTEGRITY_SHA512;
++	return STATUS_SUCCESS;
+ }
+ 
+ static void decode_encrypt_ctxt(struct ksmbd_conn *conn,
+@@ -1010,7 +1014,8 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn,
+ 				break;
+ 
+ 			status = decode_preauth_ctxt(conn,
+-						     (struct smb2_preauth_neg_context *)pctx);
++						     (struct smb2_preauth_neg_context *)pctx,
++						     len_of_ctxts);
+ 			if (status != STATUS_SUCCESS)
+ 				break;
+ 		} else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) {
+-- 
+2.35.3
+
diff --git a/series.conf b/series.conf
index 53e2f39..8c6452e 100644
--- a/series.conf
+++ b/series.conf
@@ -2330,6 +2330,7 @@
 	patches.kernel.org/6.2.12-100-tracing-Add-trace_array_puts-to-write-into-ins.patch
 	patches.kernel.org/6.2.12-101-tracing-Have-tracing_snapshot_instance_cond-wr.patch
 	patches.kernel.org/6.2.12-102-maple_tree-fix-write-memory-barrier-of-nodes-o.patch
+	patches.kernel.org/6.2.12-103-ksmbd-avoid-out-of-bounds-access-in-decode_pre.patch
 
 	########################################################
 	# Build fixes that apply to the vanilla kernel too.