CVE-2026-53010
Received Received - Intake
ksmbd Use-After-Free in smb2_open During Durable Reconnect

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-free when accessing fp properties (eg fp->create_time). Move the single put to the end of the function below err_out2 so fp stays valid until smb2_open returns.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-25
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-53010
EUVD
EUVD-2026-38878
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's ksmbd component, specifically in the smb2_open function during a durable reconnect process.

The problem occurs because the function ksmbd_put_durable_fd(fp) releases the reference to a durable file descriptor too early. If an error happens afterward or if a scavenger accesses the file, the system tries to access properties of a freed file pointer, leading to a use-after-free condition.

The fix involves moving the release of the file descriptor reference to the end of the function, ensuring the file pointer remains valid until the function completes.

Impact Analysis

This vulnerability in the Linux kernel's ksmbd component can lead to a use-after-free condition during the durable reconnect process in smb2_open. Specifically, an early release of a durable file descriptor reference can cause the system to access freed memory if an error occurs afterward or if a scavenger accesses the file. This can result in undefined behavior, potential crashes, or security issues related to memory corruption.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53010. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart