CVE-2026-43376
ksmbd Use-After-Free via Improper RCU Handling
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ksmbd component, where a use-after-free error occurs due to improper memory management of the oplock_info structure.
Specifically, ksmbd frees the oplock_info structure immediately using kfree(), even though this structure is still accessed under RCU (Read-Copy-Update) read-side critical sections in functions like opinfo_get() and proc_show_files().
Because there is no RCU grace period delay between nullifying the pointer and freeing the memory, a reader can access the oplock_info structure after it has been freed, leading to a use-after-free condition.
This is particularly problematic in opinfo_get(), where atomic_inc_not_zero() is called on memory that may have already been freed.
The fix involves switching to deferred freeing of the oplock_info structure using call_rcu(), which ensures the memory is freed only after all readers have finished accessing it.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by updating the Linux kernel to a version where the ksmbd component uses call_rcu() for deferred freeing of oplock_info instead of immediate kfree().
Therefore, the immediate mitigation step is to apply the kernel update or patch that includes this fix.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel's ksmbd component. Specifically, oplock_info structures are freed immediately without waiting for an RCU grace period, which can cause readers to access memory that has already been freed. This can result in undefined behavior, potential crashes, or security issues due to accessing invalid memory.