What is the CVSS score of CVE-2026-74522?

CVE-2026-74522 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux ksmbd are affected by CVE-2026-74522?

CVE-2026-74522 affects ksmbd (Linux kernel's native SMB/CIFS server) with a use-after-free vulnerability allowing authenticated remote attackers to corrupt kernel memory and potentially compromise…. A patch is available.

How to fix or mitigate CVE-2026-74522?

Within 24 hours, identify systems running ksmbd by checking for the smb_server kernel module and documenting affected kernel versions and release branches. Within 7 days, begin staged kernel updates to vendor-released patches (Linux 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 based on your branch), validating updates in non-production systems first to confirm application and service compatibility. Complete patching and kernel reboots system-wide within 30 days, prioritizing production file-sharing infrastructure and externally-accessible systems.

Linux ksmbd CVE-2026-74522

EUVD-2026-59715 HIGH

2026-08-15 Linux

GHSA-r5jm-2247-f5r8

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:N reflects ksmbd as a network service; AC:H assigned because successful exploitation requires a cross-session race condition with precise timing, not straightforward request injection; PR:L for required SMB authentication.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:07 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 8.8

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in __close_file_table_ids()

A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped.

If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown.

Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.

AnalysisAI

Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain valid SMB account credentials

Delivery

Establish two concurrent sessions to ksmbd service

Exploit

Open shared file handles across both sessions

Install

Race file-close against foreign reference drop

Trigger use-after-free in kernel IDR table

Execute

Reclaim freed ksmbd_file memory with controlled payload

Impact

Escalate to kernel code execution

Recon

Obtain valid SMB account credentials

Delivery

Establish two concurrent sessions to ksmbd service

Exploit

Open shared file handles across both sessions

Install

Race file-close against foreign reference drop

Trigger use-after-free in kernel IDR table

Execute

Reclaim freed ksmbd_file memory with controlled payload

Impact

Escalate to kernel code execution

Vulnerability AssessmentAI

Exploitation	The ksmbd kernel module must be explicitly loaded and actively serving SMB2/SMB3 connections - this is not the default configuration in major enterprise Linux distributions (RHEL, Ubuntu LTS, Debian), which ship and recommend userspace Samba instead. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures that ksmbd is a network service requiring only low-privileged SMB credentials, but AC:L arguably overstates ease of exploitation: the underlying defect is a cross-session race condition demanding precise concurrency between file-close and foreign-reference-drop operations, which imposes a practical exploitation difficulty above what AC:L implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker holding a low-privileged SMB account opens file handles from one authenticated session while simultaneously running a second concurrent session that acquires temporary references to the same files via internal lookup. By timing the file-close operation in the first session to race against the reference drop in the second session, the attacker triggers the use-after-free condition, leaving a freed `ksmbd_file` object in the owning session's IDR. …
Remediation	Upgrade the Linux kernel to a patched stable release: 6.6.151 or later for the 6.6 LTS branch, 6.12.103 or later for the 6.12 LTS branch, 6.18.44 or later for the 6.18 branch, or 7.1.8 or later for the 7.1 branch; the 7.2-rc6 candidate also carries the fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify systems running ksmbd by checking for the smb_server kernel module and documenting affected kernel versions and release branches. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-74522 vulnerability details – vuln.today

Back

Linux ksmbd CVE-2026-74522

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code