Executive brief
A vulnerability has been identified in the Linux kernel's SMB server component (ksmbd), which is used to share files over a network. An attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by triggering a memory management error during file open operations. This could lead to service outages or unauthorized access to sensitive data stored on the server.
Technical details
A use-after-free vulnerability exists in the ksmbd component of the Linux kernel within the smb2_open() function. The root cause is a race condition where the 'opinfo' pointer, obtained via rcu_dereference(fp->f_opinfo), is dereferenced after the rcu_read_unlock() call has been executed. This creates a window where the memory pointed to by 'opinfo' can be freed and reused before it is accessed. An authenticated remote attacker can exploit this by sending specially crafted SMB2 open requests. The fix involves using proper reference counting (opinfo_get/put) to ensure the object remains valid during its use. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel v6.1, v6.6, v6.7, v6.8, v6.10, v6.11, v6.12, v6.13, v6.14, v6.15, v6.16, v6.17, v6.18, v6.19, v7.0
Timeline
- 2026-03-03: other: Vulnerability fixed in kernel source
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/190e5f808e8058640b408ccfed25440b441a718a
- https://git.kernel.org/stable/c/1e689a56173827669a35da7cb2a3c78ed5c53680
- https://git.kernel.org/stable/c/54b48ae83de8bb06e65079d96368efe359d4909c
- https://git.kernel.org/stable/c/8f5b1a7cb009a93c48e9e334a2f59a660f9afc07
- https://git.kernel.org/stable/c/b720c84087cb547f23ce03eab93568c1769e4556
- https://git.kernel.org/stable/c/e1b21e6066615e7d3d3a7aa2677e415e563fd7cc