Linux ksmbd CVE-2026-74522

The ksmbd kernel module must be explicitly loaded and actively serving SMB2/SMB3 connections - this is not the default configuration in major enterprise Linux distributions (RHEL, Ubuntu LTS, Debian), which ship and recommend userspace Samba instead. The attacker must possess a valid SMB account with at least read access to a shared resource (CVSS PR:L confirmed by vector). Triggering the race condition requires the attacker to establish at minimum two concurrent SMB sessions to the same server and coordinate file access operations across them with precise timing - this is not passively triggerable from a single connection or by a simple unauthenticated probe. Exploitation is further constrained by: the non-default deployment status of ksmbd, the requirement for valid SMB credentials, and the inherent timing sensitivity of race-condition-based kernel UAFs which may require multiple attempts and target-specific tuning.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures that ksmbd is a network service requiring only low-privileged SMB credentials, but AC:L arguably overstates ease of exploitation: the underlying defect is a cross-session race condition demanding precise concurrency between file-close and foreign-reference-drop operations, which imposes a practical exploitation difficulty above what AC:L implies. EPSS at 0.17% (6th percentile) is consistent with this - even a mid-sized municipal IT team in tczew running ksmbd as an internal file server should prioritize patching on its normal vulnerability cadence rather than treating this as an imminent breach-level emergency. The absence of a CISA KEV entry and lack of any known public proof-of-concept further support a measured, scheduled response. The high C/I/A impact triplet is credible for a kernel UAF: successful exploitation typically enables privilege escalation to root or kernel arbitrary code execution. Risk is concentrated exclusively on Linux deployments where the ksmbd module is actively loaded - the majority of enterprise Linux deployments use userspace Samba and are not exposed.

An attacker holding a low-privileged SMB account opens file handles from one authenticated session while simultaneously running a second concurrent session that acquires temporary references to the same files via internal lookup. By timing the file-close operation in the first session to race against the reference drop in the second session, the attacker triggers the use-after-free condition, leaving a freed ksmbd_file object in the owning session's IDR. If the freed memory is reallocated and controlled before the stale pointer is dereferenced, a kernel privilege escalation path opens. No public proof-of-concept exists at time of analysis, but this class of cross-session race UAF in kernel subsystems is well-understood and has been reliably exploited in analogous Linux kernel bugs.