CVE-2026-53010

Analyzed Analyzed - Analysis Complete

ksmbd Use-After-Free in smb2_open During Durable Reconnect

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-free when accessing fp properties (eg fp->create_time). Move the single put to the end of the function below err_out2 so fp stays valid until smb2_open returns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53010

EUVD

EUVD-2026-38878

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.6.32 (inc) to 6.7 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 6.9 (inc) to 6.18.33 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Impact Analysis

This vulnerability in the Linux kernel's ksmbd component can lead to a use-after-free condition during the durable reconnect process in smb2_open. Specifically, an early release of a durable file descriptor reference can cause the system to access freed memory if an error occurs afterward or if a scavenger accesses the file. This can result in undefined behavior, potential crashes, or security issues related to memory corruption.

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's ksmbd component, specifically in the smb2_open function during a durable reconnect process.

The problem occurs because the function ksmbd_put_durable_fd(fp) releases the reference to a durable file descriptor too early. If an error happens afterward or if a scavenger accesses the file, the system tries to access properties of a freed file pointer, leading to a use-after-free condition.

The fix involves moving the release of the file descriptor reference to the end of the function, ensuring the file pointer remains valid until the function completes.

Hi! I’m here to help you understand CVE-2026-53010. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70