EUVD-2026-28685
GHSA-wvq8-6v44-2qvw
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is being accessed after rcu_read_unlock() has been called. This creates a race condition where the memory could be freed by a concurrent writer between the unlock and the subsequent pointer dereferences (opinfo->is_lease, etc.), leading to a use-after-free.
AnalysisAI
Use-after-free in Linux kernel ksmbd allows remote unauthenticated attackers to potentially execute arbitrary code, disclose sensitive information, or cause denial of service. The vulnerability stems from improper RCU lock handling in smb_lazy_parent_lease_break_close() where opinfo pointer is dereferenced after RCU read unlock, creating a race condition. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running Linux kernel versions 6.6.x through 7.0.x and verify current kernel versions. Within 7 days: Apply vendor-released patches to all affected systems (upgrade to kernel 6.6.130, 6.12.78, 6.18.19, 6.19.9, or 7.0+ as appropriate for each system's support branch); coordinate with infrastructure and development teams to schedule patching with minimal disruption. …
Sign in for detailed remediation steps.
More from same product – last 7 days
NULL pointer dereference in Ubuntu Linux kernel SAUCE patches (versions 6.8, 6.17, and 7.0) allows an unprivileged local
In the Linux kernel, the following vulnerability has been resolved: netfilter: arp_tables: fix IEEE1394 ARP payload par
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork
In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroup_storage_ge
In the Linux kernel, the following vulnerability has been resolved: openvswitch: cap upcall PID array size and pre-size
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today