CVE-2026-72492
Received Received - Intake

ksmbd Use-After-Free in SMB Lease Handling

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in same_client_has_lease() same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. smb_grant_oplock() then dereferences that pointer in copy_lease() and when checking breaking_cnt. A concurrent close can remove the old lease from ci->m_op_list and drop the last reference before the caller uses the returned pointer, leading to a use-after-free. Take a reference when same_client_has_lease() selects an existing lease, drop any previous match while scanning, and release the returned reference in smb_grant_oplock() after copying the lease state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72492
EUVD
EUVD-2026-59391

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ksmbd component. It occurs when same_client_has_lease() returns a pointer to a lease structure after releasing a lock without keeping a reference. The pointer is later dereferenced in smb_grant_oplock(), but a concurrent operation could have freed the lease, causing a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and involves a use-after-free in the lease handling code. Detection requires checking kernel logs for related crashes or examining the ksmbd module for signs of memory corruption. Commands like dmesg | grep ksmbd or journalctl -k | grep ksmbd may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code, escalate privileges, or cause a denial of service by triggering a use-after-free condition in the Linux kernel's SMB server implementation.

Mitigation Strategies

Immediately update your Linux kernel to a version that includes the fix for CVE-2026-72492. If using ksmbd, disable the service temporarily if an update is not immediately available. Monitor kernel logs for signs of exploitation or crashes. Apply kernel patches as soon as they are released by your distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72492. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart