CVE-2026-74522 (GCVE-0-2026-74522)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:38
VLAI
Title
ksmbd: fix use-after-free in __close_file_table_ids()
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8510a043d334ecdf83d4604782f288db6bf21d60 , < 19bfd90d5aaf63217735d81964585c5306158e5f (git)
Affected: 8510a043d334ecdf83d4604782f288db6bf21d60 , < 67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd (git)
Affected: 8510a043d334ecdf83d4604782f288db6bf21d60 , < 0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac (git)
Affected: 8510a043d334ecdf83d4604782f288db6bf21d60 , < 9be4a66f019ea90bd9deca70511f4f9ffebf5c6f (git)
Affected: 8510a043d334ecdf83d4604782f288db6bf21d60 , < cffbdc86393b0235383a20c8c59bc32f16036459 (git)
Affected: 8510a043d334ecdf83d4604782f288db6bf21d60 , < e7188199eff46a636f3436356f0aae039be6dd66 (git)
Affected: df30cbfd3d8a70e61ce59f63ce5ed2261799ac10 (git)
Affected: aaf1d5ebb358f546414965b39da90107a7ca7ce5 (git)
Affected: 5.15.38 , < 5.16 (semver)
Affected: 5.17.6 , < 5.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19bfd90d5aaf63217735d81964585c5306158e5f",
              "status": "affected",
              "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
              "versionType": "git"
            },
            {
              "lessThan": "67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd",
              "status": "affected",
              "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
              "versionType": "git"
            },
            {
              "lessThan": "0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac",
              "status": "affected",
              "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
              "versionType": "git"
            },
            {
              "lessThan": "9be4a66f019ea90bd9deca70511f4f9ffebf5c6f",
              "status": "affected",
              "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
              "versionType": "git"
            },
            {
              "lessThan": "cffbdc86393b0235383a20c8c59bc32f16036459",
              "status": "affected",
              "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
              "versionType": "git"
            },
            {
              "lessThan": "e7188199eff46a636f3436356f0aae039be6dd66",
              "status": "affected",
              "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "df30cbfd3d8a70e61ce59f63ce5ed2261799ac10",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aaf1d5ebb358f546414965b39da90107a7ca7ce5",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.38",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in __close_file_table_ids()\n\nA ksmbd_file can remain alive after logical close while another session\nholds a temporary reference obtained through ksmbd_lookup_fd_inode().\nksmbd_close_fd() currently marks the file closed and drops the idr-owned\nreference, but leaves the pointer published in the closing session\u0027s idr\nuntil the final reference is dropped.\n\nIf the foreign holder performs the final ksmbd_fd_put(), __put_fd_final()\nsupplies the foreign session\u0027s file table to __ksmbd_close_fd(). The object\nis then freed without being removed from its owner\u0027s idr, and the owner\nsession later dereferences the stale pointer during file-table teardown.\n\nRemove the volatile id from the owner\u0027s idr while ksmbd_close_fd() still\nholds that table\u0027s lock, and clear volatile_id before dropping\nthe idr-owned reference. A later foreign final put then only performs\nphysical destruction and cannot remove the object from the wrong table."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd, the in-kernel SMB server reached remotely over TCP port 445 via SMB2 CREATE/CLOSE/SET_INFO rename and session teardown requests.\nAC:L - An attacker controls both sides of the race by issuing concurrent SMB2 CLOSE and rename operations on the same share, then logoff or disconnect; no victim-dependent timing or memory layout is required.\nPR:L - Exploitation requires a valid authenticated SMB session and share access to open, close, and rename files; it is not reachable on pre-authentication negotiate/echo paths.\nUI:N - No end-user action is required beyond the attacker driving SMB protocol operations on their own client connection(s).\nS:U - Impact is confined to kernel memory corruption and privilege escalation on the SMB server host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Use-after-free of a freed ksmbd_file slab object during session file-table teardown enables reading attacker-influenced heap contents and building arbitrary kernel memory read primitives.\nI:H - The UAF corrupts kernel heap metadata and ksmbd_file fields (pointers, list heads), enabling heap grooming and arbitrary write or control-flow hijack for code execution as root.\nA:H - The stale IDR entry is dereferenced during __close_file_table_ids() on logoff, tree disconnect, or connection teardown, causing kernel oops/panic and repeatable remote denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:25.036Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19bfd90d5aaf63217735d81964585c5306158e5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66"
        }
      ],
      "title": "ksmbd: fix use-after-free in __close_file_table_ids()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74522",
    "datePublished": "2026-08-15T12:27:39.945Z",
    "dateReserved": "2026-08-15T05:44:03.911Z",
    "dateUpdated": "2026-08-19T16:38:25.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74522",
      "date": "2026-09-20",
      "epss": "0.00435",
      "percentile": "0.37256"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:59:44.000Z",
      "cve": "CVE-2026-74522",
      "id": "msrc_CVE-2026-74522",
      "initial_release_date": "2026-08-23T14:59:44.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: fix use-after-free in __close_file_table_ids()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74522.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/vfs_cache.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "19bfd90d5aaf63217735d81964585c5306158e5f",
                    "status": "affected",
                    "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd",
                    "status": "affected",
                    "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac",
                    "status": "affected",
                    "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9be4a66f019ea90bd9deca70511f4f9ffebf5c6f",
                    "status": "affected",
                    "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cffbdc86393b0235383a20c8c59bc32f16036459",
                    "status": "affected",
                    "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e7188199eff46a636f3436356f0aae039be6dd66",
                    "status": "affected",
                    "version": "8510a043d334ecdf83d4604782f288db6bf21d60",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "df30cbfd3d8a70e61ce59f63ce5ed2261799ac10",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "aaf1d5ebb358f546414965b39da90107a7ca7ce5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.38",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "affected",
                    "version": "5.17.6",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/vfs_cache.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in __close_file_table_ids()\n\nA ksmbd_file can remain alive after logical close while another session\nholds a temporary reference obtained through ksmbd_lookup_fd_inode().\nksmbd_close_fd() currently marks the file closed and drops the idr-owned\nreference, but leaves the pointer published in the closing session\u0027s idr\nuntil the final reference is dropped.\n\nIf the foreign holder performs the final ksmbd_fd_put(), __put_fd_final()\nsupplies the foreign session\u0027s file table to __ksmbd_close_fd(). The object\nis then freed without being removed from its owner\u0027s idr, and the owner\nsession later dereferences the stale pointer during file-table teardown.\n\nRemove the volatile id from the owner\u0027s idr while ksmbd_close_fd() still\nholds that table\u0027s lock, and clear volatile_id before dropping\nthe idr-owned reference. A later foreign final put then only performs\nphysical destruction and cannot remove the object from the wrong table."
          }
        ],
        "id": "CVE-2026-74522",
        "lastModified": "2026-08-19T17:21:08.877",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:57.433",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/19bfd90d5aaf63217735d81964585c5306158e5f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T10:37:36+00:00",
      "cve": "CVE-2026-74522",
      "id": "CVE-2026-74522",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix use-after-free in __close_file_table_ids()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74522.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-21T00:40:20Z",
      "cve": "CVE-2026-74522",
      "id": "CVE-2026-74522",
      "initial_release_date": "2026-08-15T23:51:04Z",
      "product_status:known_not_affected": "284",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74522",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74522.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.