Skip to main content

Linux Kernel ksmbd CVE-2026-72492

| EUVDEUVD-2026-59391 HIGH
2026-08-15 Linux GHSA-h9qg-8gf5-6w98
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Race condition exploitation requires precise timing (AC:H); SMB authentication required (PR:L); full kernel impact if successful (C/I/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:53 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in same_client_has_lease()

same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference.

smb_grant_oplock() then dereferences that pointer in copy_lease() and when checking breaking_cnt. A concurrent close can remove the old lease from ci->m_op_list and drop the last reference before the caller uses the returned pointer, leading to a use-after-free.

Take a reference when same_client_has_lease() selects an existing lease, drop any previous match while scanning, and release the returned reference in smb_grant_oplock() after copying the lease state.

AnalysisAI

Use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows a low-privileged authenticated SMB client to dereference freed kernel memory, potentially achieving arbitrary kernel-level code execution or sensitive information disclosure. The race condition exists between same_client_has_lease() releasing ci->m_lock without holding a reference on the returned opinfo pointer and a concurrent SMB CLOSE operation freeing that same object. Affected kernels span the 5.15 through 7.1 stable series; patches are confirmed available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates no currently observed widespread exploitation.

Technical ContextAI

ksmbd is the in-kernel SMB3 server implementation merged into the Linux mainline in kernel 5.15, residing under fs/smb/server/. The flaw is in same_client_has_lease() in the oplock subsystem: the function retrieves an opinfo pointer from the per-inode ci->m_op_list structure and returns it after releasing ci->m_lock, without incrementing the object's reference count. The caller, smb_grant_oplock(), subsequently dereferences this pointer in copy_lease() and when evaluating breaking_cnt. A concurrent SMB CLOSE on a different file descriptor sharing the same lease object can remove the opinfo from ci->m_op_list and drop the final reference, freeing the memory while the caller still holds a dangling pointer - a classic TOCTOU use-after-free pattern (CWE-416). Although the CWE field in the source data is listed as N/A, the commit description unambiguously describes CWE-416. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected branches from the ksmbd introductory commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 onward.

RemediationAI

Upgrade to the patched stable release for the deployed kernel branch: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5. Individual backported fixes are available in the Linux stable tree - for example, https://git.kernel.org/stable/c/7c3264d273d524aa6adcce23c01087271f13586f (6.1 series) and https://git.kernel.org/stable/c/aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0 (6.12 series) among others. If immediate kernel patching is not feasible, the most effective compensating control is to unload the ksmbd module (modprobe -r ksmbd) and migrate the SMB workload to Samba (userspace), which is unaffected by this kernel-level flaw; the trade-off is a service migration effort and potential performance differences. As a lighter-weight network-level control, restrict access to TCP port 445 at the perimeter and host firewall to only trusted client subnets - this reduces the attacker pool to authenticated users already on the network but does not eliminate the vulnerability. Do not rely on network segmentation alone for high-value servers.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72492 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy