CVE-2026-23427 (GCVE-0-2026-23427)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-08-05 12:21
VLAI
Title
ksmbd: fix use-after-free in durable v2 replay of active file handles
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in durable v2 replay of active file handles parse_durable_handle_context() unconditionally assigns dh_info->fp->conn to the current connection when handling a DURABLE_REQ_V2 context with SMB2_FLAGS_REPLAY_OPERATION. ksmbd_lookup_fd_cguid() does not filter by fp->conn, so it returns file handles that are already actively connected. The unconditional overwrite replaces fp->conn, and when the overwriting connection is subsequently freed, __ksmbd_close_fd() dereferences the stale fp->conn via spin_lock(&fp->conn->llist_lock), causing a use-after-free. KASAN report: [ 7.349357] ================================================================== [ 7.349607] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x75/0xe0 [ 7.349811] Write of size 4 at addr ffff8881056ac18c by task kworker/1:2/108 [ 7.350010] [ 7.350064] CPU: 1 UID: 0 PID: 108 Comm: kworker/1:2 Not tainted 7.0.0-rc3+ #58 PREEMPTLAZY [ 7.350068] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 7.350070] Workqueue: ksmbd-io handle_ksmbd_work [ 7.350083] Call Trace: [ 7.350087] <TASK> [ 7.350087] dump_stack_lvl+0x64/0x80 [ 7.350094] print_report+0xce/0x660 [ 7.350100] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 7.350101] ? __pfx___mod_timer+0x10/0x10 [ 7.350106] ? _raw_spin_lock+0x75/0xe0 [ 7.350108] kasan_report+0xce/0x100 [ 7.350109] ? _raw_spin_lock+0x75/0xe0 [ 7.350114] kasan_check_range+0x105/0x1b0 [ 7.350116] _raw_spin_lock+0x75/0xe0 [ 7.350118] ? __pfx__raw_spin_lock+0x10/0x10 [ 7.350119] ? __call_rcu_common.constprop.0+0x25e/0x780 [ 7.350125] ? close_id_del_oplock+0x2cc/0x4e0 [ 7.350128] __ksmbd_close_fd+0x27f/0xaf0 [ 7.350131] ksmbd_close_fd+0x135/0x1b0 [ 7.350133] smb2_close+0xb19/0x15b0 [ 7.350142] ? __pfx_smb2_close+0x10/0x10 [ 7.350143] ? xas_load+0x18/0x270 [ 7.350146] ? _raw_spin_lock+0x84/0xe0 [ 7.350148] ? __pfx__raw_spin_lock+0x10/0x10 [ 7.350150] ? _raw_spin_unlock+0xe/0x30 [ 7.350151] ? ksmbd_smb2_check_message+0xeb2/0x24c0 [ 7.350153] ? ksmbd_tree_conn_lookup+0xcd/0xf0 [ 7.350154] handle_ksmbd_work+0x40f/0x1080 [ 7.350156] process_one_work+0x5fa/0xef0 [ 7.350162] ? assign_work+0x122/0x3e0 [ 7.350163] worker_thread+0x54b/0xf70 [ 7.350165] ? __pfx_worker_thread+0x10/0x10 [ 7.350166] kthread+0x346/0x470 [ 7.350170] ? recalc_sigpending+0x19b/0x230 [ 7.350176] ? __pfx_kthread+0x10/0x10 [ 7.350178] ret_from_fork+0x4fb/0x6c0 [ 7.350183] ? __pfx_ret_from_fork+0x10/0x10 [ 7.350185] ? __switch_to+0x36c/0xbe0 [ 7.350188] ? __pfx_kthread+0x10/0x10 [ 7.350190] ret_from_fork_asm+0x1a/0x30 [ 7.350197] </TASK> [ 7.350197] [ 7.355160] Allocated by task 123: [ 7.355261] kasan_save_stack+0x33/0x60 [ 7.355373] kasan_save_track+0x14/0x30 [ 7.355484] __kasan_kmalloc+0x8f/0xa0 [ 7.355593] ksmbd_conn_alloc+0x44/0x6d0 [ 7.355711] ksmbd_kthread_fn+0x243/0xd70 [ 7.355839] kthread+0x346/0x470 [ 7.355942] ret_from_fork+0x4fb/0x6c0 [ 7.356051] ret_from_fork_asm+0x1a/0x30 [ 7.356164] [ 7.356214] Freed by task 134: [ 7.356305] kasan_save_stack+0x33/0x60 [ 7.356416] kasan_save_track+0x14/0x30 [ 7.356527] kasan_save_free_info+0x3b/0x60 [ 7.356646] __kasan_slab_free+0x43/0x70 [ 7.356761] kfree+0x1ca/0x430 [ 7.356862] ksmbd_tcp_disconnect+0x59/0xe0 [ 7.356993] ksmbd_conn_handler_loop+0x77e/0xd40 [ 7.357138] kthread+0x346/0x470 [ 7.357240] ret_from_fork+0x4fb/0x6c0 [ 7.357350] ret_from_fork_asm+0x1a/0x30 [ 7.357463] [ 7.357513] The buggy address belongs to the object at ffff8881056ac000 [ 7.357513] which belongs to the cache kmalloc-1k of size 1024 [ 7.357857] The buggy address is located 396 bytes inside of [ 7.357857] freed 1024-byte region ---truncated---
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8df4bcdb0a4232192b2445256c39b787d58ef14d , < b0158d9d6f4ec5941e49a0b812735db2844f9975 (git)
Affected: c8efcc786146a951091588e5fa7e3c754850cb3c , < 568a25fd7bcdfb2790f7d42aa2a440dca4435c96 (git)
Affected: c8efcc786146a951091588e5fa7e3c754850cb3c , < a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2 (git)
Affected: c8efcc786146a951091588e5fa7e3c754850cb3c , < 9b0792c3eacf01e67f356d6ef9707b0ae5022419 (git)
Affected: c8efcc786146a951091588e5fa7e3c754850cb3c , < b425e4d0eb321a1116ddbf39636333181675d8f4 (git)
Affected: 6.6.32 , < 6.6.130 (semver)
Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.20 , ≤ 6.18.* (semver)
Unaffected: 6.19.10 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b0158d9d6f4ec5941e49a0b812735db2844f9975",
              "status": "affected",
              "version": "8df4bcdb0a4232192b2445256c39b787d58ef14d",
              "versionType": "git"
            },
            {
              "lessThan": "568a25fd7bcdfb2790f7d42aa2a440dca4435c96",
              "status": "affected",
              "version": "c8efcc786146a951091588e5fa7e3c754850cb3c",
              "versionType": "git"
            },
            {
              "lessThan": "a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2",
              "status": "affected",
              "version": "c8efcc786146a951091588e5fa7e3c754850cb3c",
              "versionType": "git"
            },
            {
              "lessThan": "9b0792c3eacf01e67f356d6ef9707b0ae5022419",
              "status": "affected",
              "version": "c8efcc786146a951091588e5fa7e3c754850cb3c",
              "versionType": "git"
            },
            {
              "lessThan": "b425e4d0eb321a1116ddbf39636333181675d8f4",
              "status": "affected",
              "version": "c8efcc786146a951091588e5fa7e3c754850cb3c",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.130",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in durable v2 replay of active file handles\n\nparse_durable_handle_context() unconditionally assigns dh_info-\u003efp-\u003econn\nto the current connection when handling a DURABLE_REQ_V2 context with\nSMB2_FLAGS_REPLAY_OPERATION. ksmbd_lookup_fd_cguid() does not filter by\nfp-\u003econn, so it returns file handles that are already actively connected.\nThe unconditional overwrite replaces fp-\u003econn, and when the overwriting\nconnection is subsequently freed, __ksmbd_close_fd() dereferences the\nstale fp-\u003econn via spin_lock(\u0026fp-\u003econn-\u003ellist_lock), causing a\nuse-after-free.\n\nKASAN report:\n\n[    7.349357] ==================================================================\n[    7.349607] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x75/0xe0\n[    7.349811] Write of size 4 at addr ffff8881056ac18c by task kworker/1:2/108\n[    7.350010]\n[    7.350064] CPU: 1 UID: 0 PID: 108 Comm: kworker/1:2 Not tainted 7.0.0-rc3+ #58 PREEMPTLAZY\n[    7.350068] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[    7.350070] Workqueue: ksmbd-io handle_ksmbd_work\n[    7.350083] Call Trace:\n[    7.350087]  \u003cTASK\u003e\n[    7.350087]  dump_stack_lvl+0x64/0x80\n[    7.350094]  print_report+0xce/0x660\n[    7.350100]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[    7.350101]  ? __pfx___mod_timer+0x10/0x10\n[    7.350106]  ? _raw_spin_lock+0x75/0xe0\n[    7.350108]  kasan_report+0xce/0x100\n[    7.350109]  ? _raw_spin_lock+0x75/0xe0\n[    7.350114]  kasan_check_range+0x105/0x1b0\n[    7.350116]  _raw_spin_lock+0x75/0xe0\n[    7.350118]  ? __pfx__raw_spin_lock+0x10/0x10\n[    7.350119]  ? __call_rcu_common.constprop.0+0x25e/0x780\n[    7.350125]  ? close_id_del_oplock+0x2cc/0x4e0\n[    7.350128]  __ksmbd_close_fd+0x27f/0xaf0\n[    7.350131]  ksmbd_close_fd+0x135/0x1b0\n[    7.350133]  smb2_close+0xb19/0x15b0\n[    7.350142]  ? __pfx_smb2_close+0x10/0x10\n[    7.350143]  ? xas_load+0x18/0x270\n[    7.350146]  ? _raw_spin_lock+0x84/0xe0\n[    7.350148]  ? __pfx__raw_spin_lock+0x10/0x10\n[    7.350150]  ? _raw_spin_unlock+0xe/0x30\n[    7.350151]  ? ksmbd_smb2_check_message+0xeb2/0x24c0\n[    7.350153]  ? ksmbd_tree_conn_lookup+0xcd/0xf0\n[    7.350154]  handle_ksmbd_work+0x40f/0x1080\n[    7.350156]  process_one_work+0x5fa/0xef0\n[    7.350162]  ? assign_work+0x122/0x3e0\n[    7.350163]  worker_thread+0x54b/0xf70\n[    7.350165]  ? __pfx_worker_thread+0x10/0x10\n[    7.350166]  kthread+0x346/0x470\n[    7.350170]  ? recalc_sigpending+0x19b/0x230\n[    7.350176]  ? __pfx_kthread+0x10/0x10\n[    7.350178]  ret_from_fork+0x4fb/0x6c0\n[    7.350183]  ? __pfx_ret_from_fork+0x10/0x10\n[    7.350185]  ? __switch_to+0x36c/0xbe0\n[    7.350188]  ? __pfx_kthread+0x10/0x10\n[    7.350190]  ret_from_fork_asm+0x1a/0x30\n[    7.350197]  \u003c/TASK\u003e\n[    7.350197]\n[    7.355160] Allocated by task 123:\n[    7.355261]  kasan_save_stack+0x33/0x60\n[    7.355373]  kasan_save_track+0x14/0x30\n[    7.355484]  __kasan_kmalloc+0x8f/0xa0\n[    7.355593]  ksmbd_conn_alloc+0x44/0x6d0\n[    7.355711]  ksmbd_kthread_fn+0x243/0xd70\n[    7.355839]  kthread+0x346/0x470\n[    7.355942]  ret_from_fork+0x4fb/0x6c0\n[    7.356051]  ret_from_fork_asm+0x1a/0x30\n[    7.356164]\n[    7.356214] Freed by task 134:\n[    7.356305]  kasan_save_stack+0x33/0x60\n[    7.356416]  kasan_save_track+0x14/0x30\n[    7.356527]  kasan_save_free_info+0x3b/0x60\n[    7.356646]  __kasan_slab_free+0x43/0x70\n[    7.356761]  kfree+0x1ca/0x430\n[    7.356862]  ksmbd_tcp_disconnect+0x59/0xe0\n[    7.356993]  ksmbd_conn_handler_loop+0x77e/0xd40\n[    7.357138]  kthread+0x346/0x470\n[    7.357240]  ret_from_fork+0x4fb/0x6c0\n[    7.357350]  ret_from_fork_asm+0x1a/0x30\n[    7.357463]\n[    7.357513] The buggy address belongs to the object at ffff8881056ac000\n[    7.357513]  which belongs to the cache kmalloc-1k of size 1024\n[    7.357857] The buggy address is located 396 bytes inside of\n[    7.357857]  freed 1024-byte region \n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server and the vulnerable `SMB2_CREATE` durable-handle replay path is reachable by SMB packets over the network, typically TCP/445. The attacker can drive the needed SMB negotiate/session/tree/create/lock/close requests remotely.\nAC:L - The trigger is a deterministic sequence using attacker-chosen ClientGUID/CreateGuid values and attacker-controlled connections, not a race dependent on outside timing. Durable handles must be enabled, but that is the vulnerable configuration rather than an exploitation complexity condition.\nPR:N - `SMB2_CREATE` normally requires a valid SMB session and tree connection, but ksmbd supports guest/anonymous shares, where a remote attacker can obtain those without prior credentials. Under the required higher-severity rule, that reasonable deployment makes privileges required None.\nUI:N - No victim user action is needed; the attacker sends SMB requests directly to the ksmbd service. The same attacker can create the original handle, replay it on another connection, disconnect that connection, and later trigger close handling.\nS:U - The vulnerable component and impacted resources are the same kernel/system security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - This is a use-after-free of a `ksmbd_conn` pointer reachable from a file handle, and UAF memory corruption can plausibly be shaped into kernel memory disclosure. Following the stated kernel guidance, use-after-free warrants High confidentiality impact.\nI:H - The stale `fp-\u003econn` is later dereferenced and written through during lock-list cleanup, producing kernel heap memory corruption. Following the stated kernel guidance, a use-after-free is treated as potentially enabling arbitrary write/control-flow impact.\nA:H - The commit includes a KASAN slab-use-after-free report in `_raw_spin_lock()` during `__ksmbd_close_fd()`, which is a kernel crash/oops condition. A remote attacker can trigger this repeatedly against a reachable ksmbd service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:40.186Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b0158d9d6f4ec5941e49a0b812735db2844f9975"
        },
        {
          "url": "https://git.kernel.org/stable/c/568a25fd7bcdfb2790f7d42aa2a440dca4435c96"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b0792c3eacf01e67f356d6ef9707b0ae5022419"
        },
        {
          "url": "https://git.kernel.org/stable/c/b425e4d0eb321a1116ddbf39636333181675d8f4"
        }
      ],
      "title": "ksmbd: fix use-after-free in durable v2 replay of active file handles",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23427",
    "datePublished": "2026-04-03T15:15:14.183Z",
    "dateReserved": "2026-01-13T15:37:46.015Z",
    "dateUpdated": "2026-08-05T12:21:40.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23427",
      "date": "2026-08-07",
      "epss": "0.0029",
      "percentile": "0.21178"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23427\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-03T16:16:23.797\",\"lastModified\":\"2026-06-17T10:21:33.683\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix use-after-free in durable v2 replay of active file handles\\n\\nparse_durable_handle_context() unconditionally assigns dh_info-\u003efp-\u003econn\\nto the current connection when handling a DURABLE_REQ_V2 context with\\nSMB2_FLAGS_REPLAY_OPERATION. ksmbd_lookup_fd_cguid() does not filter by\\nfp-\u003econn, so it returns file handles that are already actively connected.\\nThe unconditional overwrite replaces fp-\u003econn, and when the overwriting\\nconnection is subsequently freed, __ksmbd_close_fd() dereferences the\\nstale fp-\u003econn via spin_lock(\u0026fp-\u003econn-\u003ellist_lock), causing a\\nuse-after-free.\\n\\nKASAN report:\\n\\n[    7.349357] ==================================================================\\n[    7.349607] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x75/0xe0\\n[    7.349811] Write of size 4 at addr ffff8881056ac18c by task kworker/1:2/108\\n[    7.350010]\\n[    7.350064] CPU: 1 UID: 0 PID: 108 Comm: kworker/1:2 Not tainted 7.0.0-rc3+ #58 PREEMPTLAZY\\n[    7.350068] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n[    7.350070] Workqueue: ksmbd-io handle_ksmbd_work\\n[    7.350083] Call Trace:\\n[    7.350087]  \u003cTASK\u003e\\n[    7.350087]  dump_stack_lvl+0x64/0x80\\n[    7.350094]  print_report+0xce/0x660\\n[    7.350100]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n[    7.350101]  ? __pfx___mod_timer+0x10/0x10\\n[    7.350106]  ? _raw_spin_lock+0x75/0xe0\\n[    7.350108]  kasan_report+0xce/0x100\\n[    7.350109]  ? _raw_spin_lock+0x75/0xe0\\n[    7.350114]  kasan_check_range+0x105/0x1b0\\n[    7.350116]  _raw_spin_lock+0x75/0xe0\\n[    7.350118]  ? __pfx__raw_spin_lock+0x10/0x10\\n[    7.350119]  ? __call_rcu_common.constprop.0+0x25e/0x780\\n[    7.350125]  ? close_id_del_oplock+0x2cc/0x4e0\\n[    7.350128]  __ksmbd_close_fd+0x27f/0xaf0\\n[    7.350131]  ksmbd_close_fd+0x135/0x1b0\\n[    7.350133]  smb2_close+0xb19/0x15b0\\n[    7.350142]  ? __pfx_smb2_close+0x10/0x10\\n[    7.350143]  ? xas_load+0x18/0x270\\n[    7.350146]  ? _raw_spin_lock+0x84/0xe0\\n[    7.350148]  ? __pfx__raw_spin_lock+0x10/0x10\\n[    7.350150]  ? _raw_spin_unlock+0xe/0x30\\n[    7.350151]  ? ksmbd_smb2_check_message+0xeb2/0x24c0\\n[    7.350153]  ? ksmbd_tree_conn_lookup+0xcd/0xf0\\n[    7.350154]  handle_ksmbd_work+0x40f/0x1080\\n[    7.350156]  process_one_work+0x5fa/0xef0\\n[    7.350162]  ? assign_work+0x122/0x3e0\\n[    7.350163]  worker_thread+0x54b/0xf70\\n[    7.350165]  ? __pfx_worker_thread+0x10/0x10\\n[    7.350166]  kthread+0x346/0x470\\n[    7.350170]  ? recalc_sigpending+0x19b/0x230\\n[    7.350176]  ? __pfx_kthread+0x10/0x10\\n[    7.350178]  ret_from_fork+0x4fb/0x6c0\\n[    7.350183]  ? __pfx_ret_from_fork+0x10/0x10\\n[    7.350185]  ? __switch_to+0x36c/0xbe0\\n[    7.350188]  ? __pfx_kthread+0x10/0x10\\n[    7.350190]  ret_from_fork_asm+0x1a/0x30\\n[    7.350197]  \u003c/TASK\u003e\\n[    7.350197]\\n[    7.355160] Allocated by task 123:\\n[    7.355261]  kasan_save_stack+0x33/0x60\\n[    7.355373]  kasan_save_track+0x14/0x30\\n[    7.355484]  __kasan_kmalloc+0x8f/0xa0\\n[    7.355593]  ksmbd_conn_alloc+0x44/0x6d0\\n[    7.355711]  ksmbd_kthread_fn+0x243/0xd70\\n[    7.355839]  kthread+0x346/0x470\\n[    7.355942]  ret_from_fork+0x4fb/0x6c0\\n[    7.356051]  ret_from_fork_asm+0x1a/0x30\\n[    7.356164]\\n[    7.356214] Freed by task 134:\\n[    7.356305]  kasan_save_stack+0x33/0x60\\n[    7.356416]  kasan_save_track+0x14/0x30\\n[    7.356527]  kasan_save_free_info+0x3b/0x60\\n[    7.356646]  __kasan_slab_free+0x43/0x70\\n[    7.356761]  kfree+0x1ca/0x430\\n[    7.356862]  ksmbd_tcp_disconnect+0x59/0xe0\\n[    7.356993]  ksmbd_conn_handler_loop+0x77e/0xd40\\n[    7.357138]  kthread+0x346/0x470\\n[    7.357240]  ret_from_fork+0x4fb/0x6c0\\n[    7.357350]  ret_from_fork_asm+0x1a/0x30\\n[    7.357463]\\n[    7.357513] The buggy address belongs to the object at ffff8881056ac000\\n[    7.357513]  which belongs to the cache kmalloc-1k of size 1024\\n[    7.357857] The buggy address is located 396 bytes inside of\\n[    7.357857]  freed 1024-byte region \\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8df4bcdb0a4232192b2445256c39b787d58ef14d\",\"lessThan\":\"b0158d9d6f4ec5941e49a0b812735db2844f9975\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8efcc786146a951091588e5fa7e3c754850cb3c\",\"lessThan\":\"568a25fd7bcdfb2790f7d42aa2a440dca4435c96\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8efcc786146a951091588e5fa7e3c754850cb3c\",\"lessThan\":\"a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8efcc786146a951091588e5fa7e3c754850cb3c\",\"lessThan\":\"9b0792c3eacf01e67f356d6ef9707b0ae5022419\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8efcc786146a951091588e5fa7e3c754850cb3c\",\"lessThan\":\"b425e4d0eb321a1116ddbf39636333181675d8f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.32\",\"lessThan\":\"6.6.130\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.20\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.10\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.32\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"D1E711D7-AEFA-4401-A4BA-765B56DBA77E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.1\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"F0FA7A38-CD76-4D81-B1C5-18B6D2770B95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.20\",\"matchCriteriaId\":\"E5571059-6552-48E7-9BEF-3E358C387171\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.10\",\"matchCriteriaId\":\"96D34333-38BE-4414-9E79-6EB764329581\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/568a25fd7bcdfb2790f7d42aa2a440dca4435c96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b0792c3eacf01e67f356d6ef9707b0ae5022419\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0158d9d6f4ec5941e49a0b812735db2844f9975\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b425e4d0eb321a1116ddbf39636333181675d8f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:20:56+00:00",
      "cve": "CVE-2026-23427",
      "id": "CVE-2026-23427",
      "initial_release_date": "2026-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix use-after-free in durable v2 replay of active file handles",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23427.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.