What is the CVSS score of CVE-2026-23428?

CVE-2026-23428 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-23428?

Within 24 hours, confirm which Linux hosts actually run ksmbd - the module is not enabled by default on most distributions - and identify any that have shares exported; for those hosts, verify whether valid SMB credentials are broadly distributed, since credential possession is a prerequisite for exploitation. Also confirm whether the kernel running on each affected host (check via uname -r) is covered by the vendor's patched kernel release. Within 7 days, schedule and apply the vendor-released kernel update per the distribution's advisory for all ksmbd-enabled systems, and in the interim restrict SMB exposure to trusted network segments and audit share configurations to remove any shares that are not operationally required. Within 30 days, complete patching across the fleet, rebuild or reboot hosts so the corrected kernel is actually running, and add kernel-version and ksmbd-module checks to vulnerability management so future kernel flaws on file-serving hosts are detected automatically.

Linux ksmbd CVE-2026-23428

EUVD-2026-18661 HIGH

Use After Free (CWE-416)

2026-04-03 Linux

GHSA-v45r-hfjf-mq4q

Linux Use After Free Memory Corruption Debian Ubuntu

7.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate SMB session to ksmbd share
Delivery

Build compound SMB2 request
Exploit

Tree-disconnect frees share_conf
Execution

Subsequent write reuses freed tcon
Persist

Trigger kernel use-after-free
Impact

Corrupt kernel heap / escalate

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires the Linux host to have the in-kernel ksmbd SMB server enabled and exporting at least one share, and the attacker must hold valid credentials to establish an authenticated SMB2 tree connect. The specific trigger is a single compound SMB2 request in which an earlier SMB2_TREE_DISCONNECT sets t_state to TREE_DISCONNECTED and frees share_conf, followed by a subsequent command (e.g. SMB2_WRITE) that reuses work->tcon and dereferences the freed share_conf. Limiting factors that reduce real-world risk: ksmbd is not enabled by default on most distributions (Samba userspace is the common SMB server instead), a valid authenticated session is needed, and the attacker must control compound-request ordering; no special user interaction is required beyond sending the crafted request.
Impact	This is a CWE-416 use-after-free in the Linux kernel's in-kernel SMB server (ksmbd), where smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without re-checking tcon->t_state, so a prior SMB2_TREE_DISCONNECT frees share_conf and a later command (e.g. SMB2_WRITE) dereferences the freed object. Signals are MIXED: the NVD CVSS of 7.8 (C:H/I:H/A:H) reflects kernel-memory corruption that can escalate to code execution, but EPSS is only 0.02% (7th percentile), there is NO CISA KEV listing, and no public exploit was identified, so this is not a widespread/opportunistic threat today. CONFLICT TO VERIFY: the NVD vector is AV:L (local), yet ksmbd is a network-facing SMB service and the bug is triggered by a crafted compound SMB2 request over the wire - the realistic attack vector is network (AV:N) from an authenticated SMB session, not local, so the AV:L label likely reflects a mechanical kernel-CVE assignment and understates remote reachability. PR:L in the vector is consistent with the fact that an attacker must first establish an authenticated tree connect. Net: a genuine kernel UAF worth patching on any host actually running ksmbd, but low real-world urgency given no exploitation activity, low EPSS, the requirement for a valid authenticated SMB session, and the fact that ksmbd is an optional, not-default service - prioritize below internet-facing unauthenticated flaws.
Exploit ScenarioDerived	An attacker holding valid credentials for a ksmbd-exported share opens an SMB2 session and sends a single compound request that first issues SMB2_TREE_DISCONNECT (freeing share_conf) and then a SMB2_WRITE that reuses the now-freed work->tcon->share_conf, triggering a kernel use-after-free. With careful heap grooming this slab-use-after-free in kmalloc-96 could be steered toward privilege escalation or kernel code execution; no public exploit code was identified at time of analysis, and the KASAN report shown is a crash reproducer rather than a weaponized exploit.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Oct 16, 2026

Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated remote attacker corrupt kernel memory, crash the host, or potentially achieve kernel code execution by sending a single crafted compound SMB2 request. The flaw sits in the compound-request fast path: smb2_get_ksmbd_tcon() reuses work->tcon without re-validating tcon->t_state, so an earlier SMB2_TREE_DISCONNECT in the same compound frees share_conf and a later command such as SMB2_WRITE dereferences the freed object (KASAN slab-use-after-free in smb2_write). Affected systems are those running a vulnerable kernel with ksmbd loaded and at least one share exported, plus a valid SMB credential; ksmbd is not enabled by default on most distributions, EPSS is only 0.02% (7th percentile), and no public exploit identified at time of analysis.

Earlier versions of this analysis (1)

v1 Apr 03, 2026 - 15:30

Use-after-free in Linux kernel ksmbd SMB server allows local or remote attackers to read freed memory and potentially achieve denial of service or code execution via compound SMB2 requests that reuse a tree connection after it has been disconnected and its associated share_conf structure freed. The vulnerability exists because smb2_get_ksmbd_tcon() bypasses state validation checks when reusing connections in compound requests, enabling subsequent commands to dereference already-freed share_conf pointers. No CVE severity metrics are available, but KASAN confirms memory corruption is triggered in smb2_write operations during tree disconnect sequences.

RemediationAI

Apply the vendor-released kernel patches that close this bug: upgrade to Linux 6.1.167, 6.6.130, 6.12.78, 6.18.20 or 6.19.10 (upstream 7.0-rc5 contains the fix), matching the stable series in use, and consume the distribution builds referenced in USN-8490-1 (https://ubuntu.com/security/notices/USN-8490-1) or the corresponding Debian update; the individual upstream fixes are published at https://git.kernel.org/stable/c/eae0dc86f71e6f3294c0cd7ffc05039258d243af, https://git.kernel.org/stable/c/806f13752652216db0c309392b4db3e64eeed4f2, https://git.kernel.org/stable/c/c742b46a153d3ff95ff0825ab1950c87b9e14470, https://git.kernel.org/stable/c/7f7468fd2a7554cea91b7d430335a3dbf01dcc09, https://git.kernel.org/stable/c/a5929c2020ce54e1dcbd1078c0f30b8aaf73c105 and https://git.kernel.org/stable/c/c33615f995aee80657b9fdfbc4ee7f49c2bd733d. Where immediate patching is not possible, the most effective compensating control is to stop exporting SMB shares from the kernel server: unload the module (rmmod ksmbd) or blacklist it and disable the ksmbd systemd unit, falling back to userspace Samba if SMB service is still required - the trade-off is loss of ksmbd's specific feature set and performance profile, and any migration must reproduce share ACLs correctly. Additionally, restrict TCP/445 to trusted management networks and disable SMBv1/legacy dialects at the perimeter, which limits who can reach the vulnerable compound-request parsing path at all; note that neither measure removes the underlying bug, so kernel updates should still be scheduled as the definitive fix.

Affected VersionsENISA

Linux 5005bcb4219156f1bf7587b185080ec1da08518e <a5929c2020ce54e1dcbd1078c0f30b8aaf73c105

Linux 5005bcb4219156f1bf7587b185080ec1da08518e <7f7468fd2a7554cea91b7d430335a3dbf01dcc09

Linux d1066c1b3663401cd23c0d6e60cdae750ce00c0f

Linux 854156d12caa9d36de1cf5f084591c7686cc8a9d <eae0dc86f71e6f3294c0cd7ffc05039258d243af

Linux 5005bcb4219156f1bf7587b185080ec1da08518e <c742b46a153d3ff95ff0825ab1950c87b9e14470

Linux patch: 0

Linux 6.4

Linux patch: 7.0-rc5

Linux patch: 6.1.167

Linux patch: 6.19.10

Linux patch: 6.12.78

Linux 5005bcb4219156f1bf7587b185080ec1da08518e <806f13752652216db0c309392b4db3e64eeed4f2

Linux patch: 6.18.20

Linux 5005bcb4219156f1bf7587b185080ec1da08518e <c33615f995aee80657b9fdfbc4ee7f49c2bd733d

Linux patch: 6.6.130

Linux eb947403518ea3d93f6d89264bb1f5416bb0c7d0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

ksmbd is the in-kernel SMB2/3 server that lives in the Linux kernel's fs/smb/server code, and this CVE is a textbook CWE-416 use-after-free caused by inconsistent state validation across code paths. During a normal tree connect, ksmbd_tree_conn_connect() calls ksmbd_share_config_get(), which allocates a 96-byte kmalloc-96 share_conf object (refcounted) and stores it in the tree connection structure. The initial lookup path in ksmbd_tree_conn_lookup() correctly guards on t_state == TREE_CONNECTED, but the compound-request reuse path in smb2_get_ksmbd_tcon() returns the cached work->tcon without that guard. Consequently, when an attacker packs SMB2_TREE_DISCONNECT and a subsequent command into one compound request, smb2_tree_disconnect() -> __ksmbd_tree_conn_disconnect() releases share_conf via ksmbd_share_config_put(), sets t_state to TREE_DISCONNECTED, and the following command (SMB2_WRITE in the reported KASAN trace) reads offset 20 inside the already-freed region. The fix restores the missing t_state check on the compound reuse path. Per the CPE data the vulnerable component is the upstream Linux kernel (cpe:2.3:a:linux:linux), with Debian and Ubuntu as affected downstream distributions.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

ksmbd is network-reachable so AV:N (not NVD's AV:L); PR:L because an authenticated SMB tree connect is required; kernel UAF yields high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Oct 16, 2026 - 15:23 NVD

CRITICAL HIGH

CVSS changed

Oct 16, 2026 - 15:23 NVD

9.8 (CRITICAL) 7.8 (HIGH)

Severity Changed

Apr 27, 2026 - 14:22 NVD

HIGH CRITICAL

CVSS changed

Apr 27, 2026 - 14:22 NVD

7.8 (HIGH) 9.8 (CRITICAL)

CVSS changed

Apr 23, 2026 - 21:11 NVD

7.8 (HIGH)

Patch available

Apr 16, 2026 - 05:29 EUVD

7f7468fd2a7554cea91b7d430335a3dbf01dcc09,806f13752652216db0c309392b4db3e64eeed4f2

CVE Published

Apr 03, 2026 - 15:15 nvd

N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free of share_conf in compound request

smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without validating tcon->t_state. ksmbd_tree_conn_lookup() checks t_state == TREE_CONNECTED on the initial lookup path, but the compound reuse path bypasses this check entirely.

If a prior command in the compound (SMB2_TREE_DISCONNECT) sets t_state to TREE_DISCONNECTED and frees share_conf via ksmbd_share_config_put(), subsequent commands dereference the freed share_conf through work->tcon->share_conf.

KASAN report:

[ 4.144653] ============== [ 4.145059] BUG: KASAN: slab-use-after-free in smb2_write+0xc74/0xe70 [ 4.145415] Read of size 4 at addr ffff88810430c194 by task kworker/1:1/44 [ 4.145772] [ 4.145867] CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted 7.0.0-rc3+ #60 PREEMPTLAZY [ 4.145871] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 4.145875] Workqueue: ksmbd-io handle_ksmbd_work [ 4.145888] Call Trace: [ 4.145892] <TASK> [ 4.145894] dump_stack_lvl+0x64/0x80 [ 4.145910] print_report+0xce/0x660 [ 4.145919] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 4.145928] ? smb2_write+0xc74/0xe70 [ 4.145931] kasan_report+0xce/0x100 [ 4.145934] ? smb2_write+0xc74/0xe70 [ 4.145937] smb2_write+0xc74/0xe70 [ 4.145939] ? __pfx_smb2_write+0x10/0x10 [ 4.145942] ? _raw_spin_unlock+0xe/0x30 [ 4.145945] ? ksmbd_smb2_check_message+0xeb2/0x24c0 [ 4.145948] ? smb2_tree_disconnect+0x31c/0x480 [ 4.145951] handle_ksmbd_work+0x40f/0x1080 [ 4.145953] process_one_work+0x5fa/0xef0 [ 4.145962] ? assign_work+0x122/0x3e0 [ 4.145964] worker_thread+0x54b/0xf70 [ 4.145967] ? __pfx_worker_thread+0x10/0x10 [ 4.145970] kthread+0x346/0x470 [ 4.145976] ? recalc_sigpending+0x19b/0x230 [ 4.145980] ? __pfx_kthread+0x10/0x10 [ 4.145984] ret_from_fork+0x4fb/0x6c0 [ 4.145992] ? __pfx_ret_from_fork+0x10/0x10 [ 4.145995] ? __switch_to+0x36c/0xbe0 [ 4.145999] ? __pfx_kthread+0x10/0x10 [ 4.146003] ret_from_fork_asm+0x1a/0x30 [ 4.146013] </TASK> [ 4.146014] [ 4.149858] Allocated by task 44: [ 4.149953] kasan_save_stack+0x33/0x60 [ 4.150061] kasan_save_track+0x14/0x30 [ 4.150169] __kasan_kmalloc+0x8f/0xa0 [ 4.150274] ksmbd_share_config_get+0x1dd/0xdd0 [ 4.150401] ksmbd_tree_conn_connect+0x7e/0x600 [ 4.150529] smb2_tree_connect+0x2e6/0x1000 [ 4.150645] handle_ksmbd_work+0x40f/0x1080 [ 4.150761] process_one_work+0x5fa/0xef0 [ 4.150873] worker_thread+0x54b/0xf70 [ 4.150978] kthread+0x346/0x470 [ 4.151071] ret_from_fork+0x4fb/0x6c0 [ 4.151176] ret_from_fork_asm+0x1a/0x30 [ 4.151286] [ 4.151332] Freed by task 44: [ 4.151418] kasan_save_stack+0x33/0x60 [ 4.151526] kasan_save_track+0x14/0x30 [ 4.151634] kasan_save_free_info+0x3b/0x60 [ 4.151751] __kasan_slab_free+0x43/0x70 [ 4.151861] kfree+0x1ca/0x430 [ 4.151952] __ksmbd_tree_conn_disconnect+0xc8/0x190 [ 4.152088] smb2_tree_disconnect+0x1cd/0x480 [ 4.152211] handle_ksmbd_work+0x40f/0x1080 [ 4.152326] process_one_work+0x5fa/0xef0 [ 4.152438] worker_thread+0x54b/0xf70 [ 4.152545] kthread+0x346/0x470 [ 4.152638] ret_from_fork+0x4fb/0x6c0 [ 4.152743] ret_from_fork_asm+0x1a/0x30 [ 4.152853] [ 4.152900] The buggy address belongs to the object at ffff88810430c180 [ 4.152900] which belongs to the cache kmalloc-96 of size 96 [ 4.153226] The buggy address is located 20 bytes inside of [ 4.153226] freed 96-byte region [ffff88810430c180, ffff88810430c1e0) [ 4.153549] [ 4.153596] The buggy address belongs to the physical page: [ 4.153750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810430ce80 pfn:0x10430c [ 4.154000] flags: 0x ---truncated---

Executive ViewAI

Why It Matters

A memory-corruption flaw in the Linux kernel's built-in SMB file-sharing component (ksmbd) can allow a user who already holds valid SMB credentials to crash - or potentially take full control of - a Linux host that has ksmbd loaded and at least one share exported. The component is not enabled by default on most distributions, and exploitation also requires an exported share and valid credentials, which narrows the realistic exposure to file-serving systems that administrators have deliberately configured. Leadership should care because a successful attack on such a host can cause unplanned downtime of a shared file service or, in the worst case, compromise of the underlying server; this is a manageable, configuration-dependent risk rather than a broad, Internet-wide one.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Prevalence

Medium

ksmbd is an optional in-kernel SMB server, rarely enabled on default Linux deployments

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Use After Free

View all

CVE-2012-4969 HIGH POC

8.1

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23428 ADVISORY https://ubuntu.com/security/notices/USN-8490-1 ADVISORY https://vuldb.com/vuln/355109 REF https://git.kernel.org/stable/c/7f7468fd2a7554cea91b7d430335a3dbf01dcc09 REF https://git.kernel.org/stable/c/806f13752652216db0c309392b4db3e64eeed4f2 REF https://git.kernel.org/stable/c/a5929c2020ce54e1dcbd1078c0f30b8aaf73c105 REF https://git.kernel.org/stable/c/c33615f995aee80657b9fdfbc4ee7f49c2bd733d REF https://git.kernel.org/stable/c/c742b46a153d3ff95ff0825ab1950c87b9e14470 REF https://git.kernel.org/stable/c/d08417981155883068b7260d9500ca306a03edac REF https://git.kernel.org/stable/c/eae0dc86f71e6f3294c0cd7ffc05039258d243af

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back