CVE-2026-89635
nicheAuthenticated use-after-free in Linux kernel ksmbd durable-handle reconnect
The Linux kernel's in-kernel SMB3 server (ksmbd) mishandles durable-handle reconnects: ksmbd_reopen_durable_fd() rebinds every detached oplock on an inode to the reconnecting session instead of only the one owned by the reopened file, so when two sessions hold durable handles on the same file, a reconnecting session adopts the other session's oplock and overwrites its session pointer without taking a reference. Once the adopting session is destroyed, a later SMB2 create carrying the other session's AppInstanceId dereferences the freed session inside ksmbd_close_fd_app_instance_id(), producing a slab use-after-free (KASAN: 4-byte write in _raw_write_lock). The flaw is reachable from an authenticated SMB session against a share with default durable-handle and oplock/lease configuration, by opening the same file with durable-v2 handles under two distinct AppInstanceIds, logging both sessions off, and reconnecting one with DH2C. Impact is kernel memory corruption — at minimum a crash/DoS of the ksmbd host, with theoretical privilege-escalation potential reflected in the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N) — though weaponizing the specific write is non-trivial. No public PoC exists and the bug is not known to be exploited in the wild; the fix constrains the reopen loop to the oplock owned by the file being reopened.
What to do: Apply the kernel update containing the fix as soon as your distribution ships it; the patch restricts oplock rebinding during durable reconnect to the file's own oplock. Until patched, blacklist the ksmbd module and serve SMB via userspace Samba instead, or at minimum keep TCP/445 off the internet and restricted to trusted clients, noting that triggering the bug requires a valid authenticated SMB session. Review kernel logs for KASAN or BUG reports referencing ksmbd_close_fd_app_instance_id or handle_ksmbd_work as evidence of attempted triggering.
| Linux kernel (ksmbd in-kernel SMB server) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbd_reopen_durable_fd() walks the inode's m_op_list and rebinds every detached oplock to the reconnecting session: list_for_each_entry_rcu(op, &ci->m_op_list, op_entry, lockdep_is_held(&ci->m_lock)) { if (op->conn) continue; op->conn = ksmbd_conn_get(fp->conn); op->sess = work->sess; } The only key is op->conn == NULL, which every detached durable handle on that inode matches, not just the one owned by fp. When two sessions hold durable handles on the same file and both disconnect, reconnecting one of them adopts the other session's oplock: op->sess is overwritten with the reconnecting session without taking a reference on it, while op->conn pins the connection. The sibling teardown path, session_fd_check(), keys on the identity of the connection being torn down (op->conn == conn) rather than on shared state, and so does not have this problem. Once the adopting session is destroyed, ksmbd_session_destroy() frees it while the foreign oplock still points at it. The reader in ksmbd_close_fd_app_instance_id() validates only opinfo->conn, which is still live thanks to the reference taken above, and then dereferences the stale session: if (!opinfo->conn) { up_read(&fp->f_ci->m_lock); goto out; } ft = &opinfo->sess->file_table; write_lock(&ft->lock); BUG: KASAN: slab-use-after-free in _raw_write_lock+0x74/0xd0 Write of size 4 at addr ffff88810a970528 by task kworker/0:0/9 Workqueue: ksmbd-io handle_ksmbd_work Call Trace: _raw_write_lock+0x74/0xd0 ksmbd_close_fd_app_instance_id+0x183/0x410 smb2_open+0x1346/0x4430 handle_ksmbd_work+0x2bb/0x7b0 Reached from an authenticated session against a share with the default durable-handle and oplock configuration: two sessions open the same file with a durable-v2 handle and an RH lease under distinct AppInstanceIds, both log off, one reconnects with DH2C, and a later durable-v2 create carrying the other AppInstanceId walks into the freed session. Constrain the loop to the oplock owned by the file being reopened.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.