CVE-2024-26592

What it actually does

Race condition between TCP connection establishment and teardown in ksmbd leads to use-after-free on struct tcp_transport inside ksmbd_tcp_new_connection, allowing kernel memory corruption with local privileges.

Why it matters to the business

Local attackers on affected Linux systems can escalate privileges to kernel level, potentially compromising the entire host and any services or data it hosts; widespread exposure in Linux distributions increases operational risk for servers using the in-kernel SMB implementation.

How an attack unfolds

An attacker with local access creates concurrent TCP connections to the ksmbd listener while triggering rapid connect/disconnect sequences; the race window allows a freed tcp_transport structure to be dereferenced during new-connection handling, resulting in arbitrary kernel read/write or code execution.

How to fix it

Update the Linux kernel to the commit 999daf367b924fdf14e9d83e034ee0f86bc17ec6 or later stable releases that contain the fix; disable ksmbd if SMB server functionality is not required.

How to confirm the fix worked

Confirm kernel source or package version contains commit 999daf367b924fdf14e9d83e034ee0f86bc17ec6; attempt to reproduce the race with connection stress tests and verify absence of UAF warnings in dmesg or KASAN logs.

Typical attack path

1. Obtain local shell on target Linux system
2. Open multiple SMB/TCP connections to localhost or local interface
3. Rapidly close connections while new ones are accepted
4. Trigger ksmbd_tcp_new_connection path during the freed-object window
5. Leverage resulting UAF for kernel memory corruption and privilege escalation

How to detect it

Review kernel logs and audit records for repeated ksmbd connection handling around the time of any crashes or unexpected privilege changes; look for processes creating many short-lived TCP connections to port 445.

What your security team should do

• Prioritize kernel updates on all systems exposing ksmbd
• Apply the fix within standard patch windows given low EPSS and no KEV listing
• Disable ksmbd module when SMB over kernel is unnecessary
• Monitor kernel logs for tcp_transport related crashes as a temporary indicator