Skip to main content

Linux Kernel CVE-2026-53010

| EUVDEUVD-2026-38878 CRITICAL
Use After Free (CWE-416)
2026-06-24 Linux GHSA-xvgg-vwv8-fvr6
Information Disclosure Linux Use After Free Memory Corruption
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.1 HIGH

Reaching the durable-reconnect path needs an authenticated SMB session (PR:L) and a timing/error race (AC:H); kernel UAF yields memory disclosure (C:H) and crash potential (A:H), with limited integrity impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:49 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
CRITICAL 9.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in smb2_open during durable reconnect

In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-free when accessing fp properties (eg fp->create_time).

Move the single put to the end of the function below err_out2 so fp stays valid until smb2_open returns.

AnalysisAI

Use-after-free in the Linux kernel's ksmbd in-kernel SMB3 server occurs during durable handle reconnect, where smb2_open prematurely drops the durable file reference via ksmbd_put_durable_fd(fp); a subsequent error path or scavenger access then dereferences freed fp fields (e.g., fp->create_time). Affecting Linux ksmbd across multiple stable branches and fixed in releases such as 6.6.32, 6.18.33, 7.0.10, and 7.1, the flaw is rated CVSS 9.8 but carries a low EPSS of 0.17% (6th percentile); it is not in CISA KEV and no public exploit identified at time of analysis. An attacker with SMB access can trigger memory corruption potentially leading to information disclosure, denial of service, or code execution in kernel context.

Technical ContextAI

ksmbd is the Linux kernel's native SMB3 file-server implementation (CONFIG_SMB_SERVER), an alternative to userspace Samba that runs protocol handling in kernel space. The bug lives in the SMB2 CREATE handler (smb2_open) during durable handle reconnect - an SMB feature allowing clients to re-acquire a previously opened file handle after a transient network drop, tracked by a persistent/durable file pointer (struct ksmbd_file *fp). The defect is a reference-counting ordering error: ksmbd_put_durable_fd(fp) releases the durable reference too early, so if a later step like ksmbd_iov_pin_rsp() fails, or a background scavenger thread reaps the durable handle concurrently, the code still accesses fp afterward. This is a classic use-after-free (CWE-416, though the input lists CWE as N/A) on a kernel heap object, with the fix simply moving the single put past the err_out2 label so fp remains valid until the function returns.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel release for your branch - the patched versions noted include 6.6.32, 6.18.33, 7.0.10, and 7.1; apply the corresponding stable update shipped by your distribution that incorporates upstream commits ce2e164c, 97a0cd55, and 1baff47b (https://git.kernel.org/stable/c/ce2e164c1c51c3f7813b80f8c926836e896bcbb3). Because exact branch-to-fix mapping varies, confirm the build via your distro's kernel security advisory and reboot into the patched kernel. Where immediate patching is not possible, the most effective compensating control is to disable the ksmbd in-kernel server (stop the ksmbd service and unload the module: do not export shares via ksmbd), optionally falling back to userspace Samba - the trade-off is loss of the in-kernel SMB server's performance benefit. Alternatively, restrict network reachability of TCP/445 to trusted clients via host or network firewall rules to limit who can establish the SMB sessions needed to reach the durable-reconnect path; the side effect is reduced SMB accessibility for legitimate remote clients. If durable handles are not required, disabling that capability removes the vulnerable reconnect flow.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53010 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy