Executive brief
ksmbd is a kernel-level SMB server implementation used in Linux systems to enable Windows-compatible file sharing. When two client sessions reconnect to durable file handles on the same file and one reconnects before the other terminates, the kernel incorrectly rebinds the other session's oplock (file lock) to the reconnecting session. After the first session is destroyed, this creates a dangling pointer, leading to memory corruption and potential code execution with kernel privileges.
Technical details
This is a use-after-free vulnerability in ksmbd's durable reconnect handler (ksmbd_reopen_durable_fd()). The root cause is overly permissive rebinding logic: when reopening a durable file handle, the code walks the inode's oplock list and rebinds all detached oplocks (op->conn == NULL) without verifying ownership. When two sessions hold durable handles on the same file and disconnect, reconnecting one session adopts the other session's oplock by overwriting op->sess without taking a reference, while op->conn still holds the first session's connection reference. Once the first session is destroyed, ksmbd_session_destroy() frees it while the stale oplock still points to it. Later attempts to access the oplock's session pointer trigger a use-after-free. The attack requires authentication and can be triggered via two simultaneous durable-v2 creates with distinct AppInstanceIds followed by reconnection. A fix constrains the rebinding loop to only the oplock owned by the file being reopened.
Affected products
- Linux Linux kernel ksmbd before resolution of CVE-2026-89635
Timeline
- 2026-09-11: disclosed: CVE-2026-89635 published
- 2026-09-11: other: Reported as critical with CVSS 9.8; not yet exploited in the wild but affecting authenticated users