CVE-2026-80926
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.
Risk Assessment
An authenticated attacker can trigger a use-after-free, potentially causing a kernel crash or arbitrary code execution in kernel context. In environments exposing SMB file shares via ksmbd, the risk applies to any logged-in client.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2026-80926. If immediate patching is not possible, consider restricting access to the ksmbd/SMB service to trusted clients only.
Other vulnerabilities in Linux kernel (ksmbd)
See all- CVE-2026-89788Critical
In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.
- CVE-2026-89635Critical
In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.
- CVE-2026-43376Critical
A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.
- CVE-2026-43185Critical
The ksmbd module in the Linux kernel has a signedness bug in smb_direct_prepare_negotiation(). An unsigned __u32 value from preferred_send_size is cast to a signed int before computing min_t(int, ...), so a malicious value of 0x80000000 is treated as smaller than max_recv_size and used to set the maximum allowed receive size. By sending a second message with a large value (>1420 bytes), the attacker can achieve a heap buffer overflow.
- CVE-2026-23428Critical
A use-after-free vulnerability exists in the Linux kernel ksmbd module involving the share_conf object in compound requests. smb2_get_ksmbd_tcon() reuses work->tcon without validating tcon->t_state, so after an earlier SMB2_TREE_DISCONNECT frees share_conf, subsequent commands dereference the freed memory.
- CVE-2023-54203Critical
In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.
- CVE-2023-38432Critical
An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.
- CVE-2023-38431Critical
An issue was discovered in the Linux kernel before 6.3.8 related to the lack of validation of the NetBIOS header's length in relation to SMB header sizes in ksmbd. This leads to an out-of-bounds read.
- CVE-2023-38427Critical
An issue was discovered in the Linux kernel before 6.3.8 related to integer underflow and out-of-bounds read in the deassemble_neg_contexts function in fs/smb/server/smb2pdu.c in ksmbd.
- CVE-2026-98420Low risk· EPSS 14%
In the Linux kernel, the ksmbd (SMB server) module mishandles SMB2 session expiration. The ksmbd_session_register() function destroyed valid sessions after ten seconds of inactivity whenever a client started another SessionSetup exchange, confusing Session.IdleTime with Session.ExpirationTime. This invalidated tree connects and caused mapped drives to fail with STATUS_NETWORK_NAME_DELETED.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opinfo->conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo->conn and drops its conn reference under ci->m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock. Thread the caller's inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target's oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo->o_fp, which a concurrent close may free. Select and pin the connection under ci->m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo->conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to the work item and release it on allocation failures.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS