CVE-2026-72422

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE

conn->preauth_info is shared connection state (struct

preauth_integrity_info, kmalloc-96) that is allocated and freed by the

SMB2 NEGOTIATE handler and read by the response send path.

smb2_handle_negotiate() allocates conn->preauth_info, and on a

deassemble_neg_contexts() failure kfrees it and sets it to NULL. Both the

allocation and the free/NULL happen under ksmbd_conn_lock(conn) (the

connection srv_mutex), which is held across the whole handler body.

The response send path smb3_preauth_hash_rsp(), called from the send:

block of __handle_ksmbd_work(), reads conn->preauth_info and dereferences

conn->preauth_info->Preauth_HashValue (via

ksmbd_gen_preauth_integrity_hash()) without taking conn_lock. When a

client drives two SMB2 NEGOTIATE requests on the same connection, one

worker can free conn->preauth_info on the failing-negotiate path wh

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References