Skip to main content

Linux ksmbd CVE-2026-68381

| EUVDEUVD-2026-55567 CRITICAL
2026-08-10 Linux GHSA-gq9g-pv9h-2q5v
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Network-reachable but a teardown timing race gives AC:H; reaching the oplock path needs a session so PR:L; freed-conn UAF most reliably crashes the kernel (A:H) with limited, uncertain C/I.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:55 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
9.8 (CRITICAL)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:03 cve.org
CRITICAL 9.8
CVE Published
Aug 10, 2026 - 12:03 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: pin conn during async oplock break notification

smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object.

If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes. The worker then uses the freed conn in ksmbd_conn_write() and ksmbd_conn_r_count_dec().

Take a real conn reference when publishing the conn pointer to the async work item, and drop it after the notification work has decremented r_count. Apply the same lifetime rule to lease break notification, which uses the same work->conn pattern.

AnalysisAI

Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) allows the async oplock/lease break notification worker to operate on a freed ksmbd_conn object when connection teardown races with a pending break notification. Affected kernels span the 6.6.x through 6.18 stable series (fixed in 6.6.148, 6.12.101, 6.14, 6.18.42 and related patch releases); the fix pins a real conn reference for the queued work item. Rated CVSS 9.8 by the automated feed, but this is a timing-dependent race with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).

Technical ContextAI

ksmbd is the Linux kernel's native SMB3 file-server implementation (an in-kernel alternative to userspace Samba), handling CIFS/SMB protocol operations including oplocks and leases used for client-side caching coordination. The root cause is a lifetime/reference-counting bug (a use-after-free, CWE-416, though the feed reports CWE as N/A): smb2_oplock_break_noti() and smb2_lease_break_noti() stash a struct ksmbd_conn pointer into an async ksmbd_work and queue it on the ksmbd-io workqueue, incrementing only conn->r_count. That counter blocks the teardown path's pending-request wait but does not hold a reference on the ksmbd_conn allocation itself, so the last conn reference can be dropped and the object freed while the worker later dereferences it in ksmbd_conn_write() and ksmbd_conn_r_count_dec(). The affected CPE is cpe:2.3:a:linux:linux, the ksmbd subsystem specifically.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.148, 6.12.101, 6.14, or 6.18.42 (mainline 7.1.6 / 7.2-rc4), matching your branch, or apply your distribution's backport of the referenced git.kernel.org stable commits (e.g. 6ecb252efa0b413ac3d9979fb4eec247f8fc1258). Because exploitation requires the in-kernel SMB server to be reachable, the most effective compensating control where patching must wait is to stop and unload the ksmbd module (modprobe -r ksmbd) if the host is not intentionally serving SMB via ksmbd - many environments run userspace Samba instead and can disable ksmbd with no service impact. If ksmbd must stay running, restrict TCP/445 exposure with a firewall so only trusted management/client networks can reach the SMB service and require authenticated (non-guest) shares, which raises the bar for reaching the vulnerable oplock/lease path; the trade-off is reduced accessibility for legitimate clients on other subnets. Track the advisory via the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-68381).

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-68381 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy