CVE-2026-74522

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in __close_file_table_ids()

A ksmbd_file can remain alive after logical close while another session

holds a temporary reference obtained through ksmbd_lookup_fd_inode().

ksmbd_close_fd() currently marks the file closed and drops the idr-owned

reference, but leaves the pointer published in the closing session's idr

until the final reference is dropped.

If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final()

supplies the foreign session's file table to __ksmbd_close_fd(). The object

is then freed without being removed from its owner's idr, and the owner

session later dereferences the stale pointer during file-table teardown.

Remove the volatile id from the owner's idr while ksmbd_close_fd() still

holds that table's lock, and clear volatile_id before dropping

the idr-owned reference. A later foreign final put then only performs

physical destruction and cannot remove the obje

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References