Executive brief
The Linux kernel's ksmbd component, which handles SMB protocol file sharing, contains a race condition that can cause a connection object to be freed while still in use. An attacker could exploit this to crash the system or potentially execute arbitrary code with kernel privileges by triggering concurrent session logoff and tree connection operations.
Technical details
The vulnerability is a use-after-free in the smb2_tree_connect() function within fs/smb/server/smb2pdu.c. The root cause is a race condition where ksmbd_tree_conn_connect() publishes a new tree connection to a shared xarray with a single reference, then releases the lock before completing initialization. A concurrent session logoff can erase the entry and drop the reference, freeing the object while smb2_tree_connect() continues to use it. The fix implements proper reference counting: the xarray entry retains one reference, the handler takes a second reference before releasing the lock, and both paths (normal exit and error cleanup) properly balance the references. The attack requires network connectivity to an SMB server and ability to establish concurrent SMB sessions.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-09-16: disclosed