CVE-2022-47939

What it actually does

Use-after-free vulnerability in ksmbd's SMB2_TREE_DISCONNECT handling in fs/ksmbd/smb2pdu.c that triggers an OOPS condition in affected Linux kernels.

Why it matters to the business

Remote attackers can crash Linux file servers or potentially execute arbitrary code, disrupting network file sharing services and requiring urgent kernel updates on systems using ksmbd.

How an attack unfolds

An unauthenticated remote attacker sends a crafted SMB2_TREE_DISCONNECT request over the network to the ksmbd server, triggering the use-after-free condition that leads to kernel instability or code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit cf6531d98190fa2cf92a6d8bbc8af0a4740a223c (fixes in 5.19.2 and later stable branches); disable ksmbd if SMB server functionality is not required.

How to confirm the fix worked

Verify kernel version is 5.19.2 or newer with the referenced commit applied; confirm ksmbd module loads without the vulnerable code path and test SMB2_TREE_DISCONNECT operations under load.

Typical attack path

1. Identify exposed ksmbd instances on TCP port 445
2. Send malicious SMB2_TREE_DISCONNECT packet
3. Trigger use-after-free and OOPS in kernel memory handling
4. Leverage resulting memory corruption for remote code execution or denial of service

How to detect it

Review kernel logs for OOPS or panic messages referencing ksmbd or smb2pdu.c; inspect network traffic for anomalous SMB2_TREE_DISCONNECT requests from untrusted sources; correlate with high-volume SMB session teardown attempts.

What your security team should do

• Apply the kernel patch containing cf6531d98190fa2cf92a6d8bbc8af0a4740a223c immediately on all exposed systems
• Monitor EPSS score and restrict SMB access from untrusted networks until patched
• Audit for ksmbd usage and consider migrating to supported SMB implementations if ksmbd is non-essential