Cloudanix VulnDB

CVE-2026-80926

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux file sharing code can let someone with login access crash or take control of the server.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in smb2_oplock_break_noti() where opinfo->conn is accessed without locking and dereferenced after allocations that may sleep, allowing a concurrently freed ksmbd_conn to be resurrected via atomic_inc and later used in ksmbd_conn_write().

Why it matters to the business

Remote authenticated attackers can crash or potentially compromise Linux systems exposing SMB shares via ksmbd, resulting in denial of service, data exposure, or full system takeover on file servers.

How an attack unfolds

An authenticated client holding a durable batch oplock races an oplock break notification against session teardown; session_fd_check() clears the conn pointer under lock while a concurrent break work item performs an unlocked ksmbd_conn_get() and later dereferences the freed object.

How to fix it

Apply the upstream kernel fix that passes the caller's inode through the notification path, selects and pins the connection under ci->m_lock, and transfers the reference to the work item.

How to confirm the fix worked

Confirm the patched kernel source contains the inode threading and lock-protected conn selection logic; test by exercising oplock break paths concurrently with durable handle close operations and verify no use-after-free reports occur.

Typical attack path

  1. Authenticate to ksmbd and obtain a durable batch oplock on a file
  2. Initiate disconnection of the durable handle from one session
  3. Trigger an oplock break notification from a second connection that races the teardown
  4. Cause the queued break work to dereference the stale conn pointer via ksmbd_conn_write()

How to detect it

Inspect kernel logs and dmesg for use-after-free warnings, slab corruption, or oops involving ksmbd_conn, smb2_oplock_break_noti, or ksmbd_conn_write during SMB session teardown.

What your security team should do

  • Update to a kernel containing the oplock break notification fix as soon as available
  • Disable ksmbd if SMB serving is not required or restrict it to authenticated, trusted clients only
  • Enable kernel hardening features such as KASAN in test environments to surface use-after-free conditions

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opinfo->conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo->conn and drops its conn reference under ci->m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock. Thread the caller's inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target's oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo->o_fp, which a concurrent close may free. Select and pin the connection under ci->m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo->conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to the work item and release it on allocation failures.

Affected packages

Ecosystem Package Introduced Fixed