CVE-2026-74522

Received Received - Intake

Use-After-Free in ksmbd Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74522

EUVD

EUVD-2026-59715

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ksmbd (SMB server) component. It occurs when a file handle remains accessible after being logically closed, allowing another session to hold a reference. When the final reference is dropped, the file object is freed without removing it from the session's file table, leading to a stale pointer dereference during cleanup.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation. Detection requires checking if your system runs a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions. Look for logs indicating ksmbd use-after-free errors during file operations.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition by crashing the system or corrupting memory. It may also enable unauthorized access to file resources if exploited to manipulate file handles improperly.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel use-after-free issue in the ksmbd file server component. It may indirectly impact compliance if exploited to access or modify sensitive data, but no evidence suggests such impact in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, disable the ksmbd service temporarily to prevent exploitation until the update is applied.

Hi! I’m here to help you understand CVE-2026-74522. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70