CVE-2026-23427

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in durable v2 replay of active file handles

parse_durable_handle_context() unconditionally assigns dh_info->fp->conn

to the current connection when handling a DURABLE_REQ_V2 context with

SMB2_FLAGS_REPLAY_OPERATION. ksmbd_lookup_fd_cguid() does not filter by

fp->conn, so it returns file handles that are already actively connected.

The unconditional overwrite replaces fp->conn, and when the overwriting

connection is subsequently freed, __ksmbd_close_fd() dereferences the

stale fp->conn via spin_lock(&fp->conn->llist_lock), causing a

use-after-free.

KASAN report:

[ 7.349357] ==================================================================

[ 7.349607] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x75/0xe0

[ 7.349811] Write of size 4 at addr ffff8881056ac18c by task kworker/1:2/108

[ 7.350010]

[ 7.350064] CPU: 1 UID: 0 PID: 108 Comm: kworker/1:2 Not tainted 7.0.0-rc3+ #58

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References