CVE-2026-23226

What it actually does

The vulnerability is a use-after-free in the Linux kernel ksmbd module caused by missing synchronization on the ksmbd_chann_list xarray; concurrent multi-channel session operations between lookup_chann_list() and ksmbd_chann_del() can dereference freed memory.

Why it matters to the business

Systems running vulnerable Linux kernels with ksmbd enabled face risk of remote kernel compromise by authenticated users, which can result in full host takeover, data exfiltration, or denial of service; organizations relying on SMB multi-channel sessions should prioritize patching to avoid operational disruption.

How an attack unfolds

An attacker with valid SMB credentials establishes a multi-channel session, then issues concurrent operations that race lookup and deletion on the unprotected xarray; the resulting use-after-free enables memory corruption that is leveraged for kernel code execution.

How to fix it

Apply the upstream fix by updating to the Linux kernel commit e4a8a96a93d08570e0405cfd989a8a07e5b6ff33 or later; disable ksmbd entirely if multi-channel SMB is not required.

How to confirm the fix worked

Confirm the kernel tree contains the chann_lock rw_semaphore in struct ksmbd_session and that all xa_load/xa_store/xa_erase calls on ksmbd_chann_list are protected by the new lock.

Typical attack path

1. Obtain valid credentials for the SMB service
2. Establish a multi-channel SMB session
3. Trigger concurrent channel lookup and deletion operations
4. Trigger the use-after-free via the unsynchronized xarray
5. Exploit the resulting memory corruption for privilege escalation

How to detect it

Search kernel logs and dmesg for ksmbd channel or xarray warnings, oops, or use-after-free reports; inspect SMB session establishment logs for anomalous multi-channel activity from untrusted sources.

What your security team should do

• Patch affected kernels to the fixed commit without delay
• Disable ksmbd or multi-channel support where feasible until patched
• Review SMB exposure and restrict authenticated access
• Monitor kernel logs for ksmbd-related crashes or warnings