CVE-2026-23428
Use-After-Free in Linux ksmbd Compound Request Handling
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.4 |
| linux | linux_kernel | From 6.3.10 (inc) to 6.4 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.7 (inc) to 6.12.78 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.20 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.10 (exc) |
| linux | linux_kernel | From 6.4.1 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 5.15.121 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 6.1.36 (inc) to 6.1.167 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a use-after-free error in the ksmbd component of the Linux kernel related to SMB2 compound requests. Detection can be done by monitoring kernel logs for KASAN (Kernel Address Sanitizer) reports indicating slab-use-after-free errors in smb2_write or related ksmbd functions.
You can check your kernel logs for messages similar to the following KASAN report lines which indicate the presence of this vulnerability:
- dmesg | grep -i kasan
- journalctl -k | grep -i ksmbd
- journalctl -k | grep -i 'use-after-free'
These commands help identify if the kernel has logged any use-after-free bugs related to ksmbd or smb2_write, which are symptomatic of this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Linux kernel to a version where this vulnerability has been fixed. The issue is resolved by correcting the use-after-free in ksmbd related to share_conf in compound requests.
If updating the kernel is not immediately possible, consider disabling or restricting the use of ksmbd or SMB2 compound requests to reduce exposure.
Monitoring kernel logs for related errors and avoiding workloads that trigger compound SMB2 requests can also help mitigate risk until a patch is applied.
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's ksmbd component, which handles SMB2 protocol requests. Specifically, the function smb2_get_ksmbd_tcon() reuses a connection object (work->tcon) in compound requests without properly checking if the connection state (tcon->t_state) is valid. If a previous command in the compound request disconnects the tree connection and frees the associated share configuration (share_conf), subsequent commands may dereference this freed memory, leading to a use-after-free condition.
How can this vulnerability impact me? :
The use-after-free vulnerability can lead to undefined behavior such as kernel crashes, memory corruption, or potential escalation of privileges. Since the freed memory is accessed after being released, it could be exploited by an attacker to execute arbitrary code or cause denial of service by crashing the system.