CVE-2026-68381

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux kernel's built-in file-sharing service can let remote attackers crash the system or run their own code, so servers should be updated promptly.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Full Compromise
Component: OS kernel
Class: Use After Free
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Use-after-free in ksmbd when async oplock/lease break work items hold a conn pointer that can be freed during connection teardown because only r_count is incremented rather than a proper reference being taken on the ksmbd_conn object.

Why it matters to the business

Remote attackers can crash or execute arbitrary code in the kernel on systems exposing SMB services, resulting in denial of service, data breach, or full host compromise; the issue affects Linux distributions shipping ksmbd and requires urgent patching despite low current exploitation probability.

How an attack unfolds

An attacker establishes an SMB session, triggers an oplock or lease break notification that queues async work holding a conn pointer, then races connection teardown so the final reference is dropped before the worker runs, causing the worker to dereference a freed ksmbd_conn in write or reference-count paths.

How to fix it

Upgrade the Linux kernel to a version containing the referenced fix that takes a proper conn reference when publishing the pointer to async work items and drops it after the notification completes; rebuild and reboot affected systems or apply vendor backports.

How to confirm the fix worked

Confirm the kernel source contains the patch adding ksmbd_conn_get/put around async work publication for both smb2_oplock_break_noti and smb2_lease_break_noti; verify no more use of raw conn pointers without reference counting; test SMB workloads that exercise oplock/lease breaks under connection churn.

Typical attack path

Establish authenticated or anonymous SMB connection to ksmbd
Perform file operations that elicit oplock or lease break notifications
Abruptly close or reset the connection to race with queued async work
Trigger reuse of the now-freed conn object inside ksmbd_conn_write or r_count helpers

How to detect it

Search kernel logs and SMB audit trails for unexpected ksmbd_conn use-after-free oops or warnings around connection teardown coinciding with oplock or lease break events; correlate with unusual SMB session resets or high rates of async notification work items.

What your security team should do

Prioritize kernel updates on all hosts running ksmbd (SMB server) within the next patching cycle
Disable ksmbd if SMB server functionality is not required
Monitor upstream stable and distribution kernels for the exact fix commit
Apply network segmentation or firewall rules to limit SMB exposure until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object. If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes. The worker then uses the freed conn in ksmbd_conn_write() and ksmbd_conn_r_count_dec(). Take a real conn reference when publishing the conn pointer to the async work item, and drop it after the notification work has decremented r_count. Apply the same lifetime rule to lease break notification, which uses the same work->conn pattern.

Affected packages

Ecosystem	Package	Introduced	Fixed