CVE-2026-53010
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module's smb2_open function during durable reconnect. Premature release of the file descriptor reference leads to use of freed memory when accessing file properties upon error or scavenger access.
Risk Assessment
An attacker could exploit this vulnerability for remote code execution or denial of service (DoS) by sending a crafted SMB2 request during durable reconnect.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit moving ksmbd_put_durable_fd to the end of smb2_open).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-free when accessing fp properties (eg fp->create_time). Move the single put to the end of the function below err_out2 so fp stays valid until smb2_open returns.