CVE-2026-89788
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.
Risk Assessment
The vulnerability can lead to kernel memory corruption, system crash (panic), or potentially arbitrary code execution by a remote attacker with access to the SMB service. It affects file servers running ksmbd.
Recommendation
Update the Linux kernel to a version containing the fix that takes an additional reference after publishing the tree connection and properly manages the object's lifecycle. If updating is not possible, consider disabling the ksmbd service or restricting access to it.
Other vulnerabilities in Linux kernel (ksmbd)
See all- CVE-2026-89635Critical
In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.
- CVE-2026-80926Critical
A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.
- CVE-2026-43376Critical
A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.
- CVE-2023-54203Critical
In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.
- CVE-2023-38432Critical
An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.
- CVE-2023-38431Critical
An issue was discovered in the Linux kernel before 6.3.8 related to the lack of validation of the NetBIOS header's length in relation to SMB header sizes in ksmbd. This leads to an out-of-bounds read.
- CVE-2023-38427Critical
An issue was discovered in the Linux kernel before 6.3.8 related to integer underflow and out-of-bounds read in the deassemble_neg_contexts function in fs/smb/server/smb2pdu.c in ksmbd.
- CVE-2026-31432High
A vulnerability has been identified in the Linux kernel that allowed for out-of-bounds writes when processing compound requests in ksmbd. The issue occurred when the first command in a request consumed most of the response buffer, leading to errors in building the security descriptor.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect() publishes a new tree connection in sess->tree_conns with a single reference and returns its pointer to smb2_tree_connect(). The handler continues to initialize the object and build the response after publication. A concurrent session logoff can erase the connection and drop that reference, freeing the object while the handler still uses it. BUG: KASAN: slab-use-after-free in smb2_tree_connect+0xe3d/0xf90 smb2_tree_connect (fs/smb/server/smb2pdu.c:2872) handle_ksmbd_work process_one_work worker_thread kthread After xa_store() succeeds, take a second reference before releasing tree_conns_lock. The original reference belongs to the xarray entry and the second belongs to the creating smb2_tree_connect() handler. Keep the references balanced in every path: - On normal exit or an error after publication, smb2_tree_connect() drops its creator reference. Error cleanup also calls ksmbd_tree_conn_disconnect(), which drops the xarray reference only if it removes the exact entry. - SMB2 TREE_DISCONNECT uses the same helper to remove the entry and drop its xarray reference. The request's existing lookup reference remains owned by the request and is released by the existing cleanup. - Session LOGOFF removes each entry and drops its xarray reference. If it wins the race, later cleanup sees that the entry is gone and does not drop that reference again. To enforce this ownership, claim the disconnected state and erase the exact entry atomically under tree_conns_lock. This guarantees one drop for the xarray reference and one drop by each in-flight user, regardless of which teardown path wins. If logoff removes the entry before initialization completes, fail the connect instead of marking the detached object TREE_CONNECTED.