CVE-2026-43378

Modified Modified - Updated After Analysis

Linux Kernel SMB Server Use-After-Free Vulnerability

Publication date: 2026-05-08

Last updated on: 2026-05-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-08

Last Modified

2026-05-20

Generated

2026-07-09

AI Q&A

2026-05-08

EPSS Evaluated

2026-07-08

NVD

CVE-2026-43378

EUVD

EUVD-2026-28684

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.2 (inc) to 6.6.130 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.19 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.78 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.9 (exc)
linux	linux_kernel	From 5.15 (inc) to 6.1.167 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's SMB server component, specifically in the smb2_open() function.

The problem occurs because a pointer named opinfo, which is obtained via rcu_dereference(fp->f_opinfo), is accessed after the rcu_read_unlock() call. This creates a window where the pointer may reference freed memory, leading to a use-after-free condition.

Impact Analysis

A use-after-free vulnerability can lead to unpredictable behavior including system crashes, data corruption, or potential execution of arbitrary code by an attacker.

In this case, since it affects the SMB server in the Linux kernel, an attacker might exploit this flaw to compromise the server's stability or security, potentially gaining unauthorized access or causing denial of service.

Hi! I’m here to help you understand CVE-2026-43378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70