CVE-2026-68381 (GCVE-0-2026-68381)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-17 05:04
VLAI
Title
ksmbd: pin conn during async oplock break notification
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object. If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes. The worker then uses the freed conn in ksmbd_conn_write() and ksmbd_conn_r_count_dec(). Take a real conn reference when publishing the conn pointer to the async work item, and drop it after the notification work has decremented r_count. Apply the same lifetime rule to lease break notification, which uses the same work->conn pattern.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 09aeab68033161cb54f194da93e51a11aee6144b , < 0f72fc9659d7f585460d43c158055df5afdcffb6 (git)
Affected: a4261bbc33fbf99b99c80aa3a2c5097611802980 , < 793e1c7041b93af96ff87e678329bc16aee7ba88 (git)
Affected: 3aa660c059240e0c795217182cf7df32909dd917 , < 6ecb252efa0b413ac3d9979fb4eec247f8fc1258 (git)
Affected: 3aa660c059240e0c795217182cf7df32909dd917 , < 14062c74e5b25c27edcff7a2fe0dc701c930b372 (git)
Affected: 3aa660c059240e0c795217182cf7df32909dd917 , < aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9 (git)
Affected: f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa (git)
Affected: 6.6.84 , < 6.6.148 (semver)
Affected: 6.12.20 , < 6.12.101 (semver)
Affected: 6.13.8 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/oplock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f72fc9659d7f585460d43c158055df5afdcffb6",
              "status": "affected",
              "version": "09aeab68033161cb54f194da93e51a11aee6144b",
              "versionType": "git"
            },
            {
              "lessThan": "793e1c7041b93af96ff87e678329bc16aee7ba88",
              "status": "affected",
              "version": "a4261bbc33fbf99b99c80aa3a2c5097611802980",
              "versionType": "git"
            },
            {
              "lessThan": "6ecb252efa0b413ac3d9979fb4eec247f8fc1258",
              "status": "affected",
              "version": "3aa660c059240e0c795217182cf7df32909dd917",
              "versionType": "git"
            },
            {
              "lessThan": "14062c74e5b25c27edcff7a2fe0dc701c930b372",
              "status": "affected",
              "version": "3aa660c059240e0c795217182cf7df32909dd917",
              "versionType": "git"
            },
            {
              "lessThan": "aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9",
              "status": "affected",
              "version": "3aa660c059240e0c795217182cf7df32909dd917",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.148",
              "status": "affected",
              "version": "6.6.84",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/oplock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.6.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.12.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: pin conn during async oplock break notification\n\nsmb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn\npointer in an async ksmbd_work and then queue that work on ksmbd-io.  The\nwork only increments conn-\u003er_count, which prevents teardown from passing\nthe pending-request wait after the increment, but it does not pin the\nstruct ksmbd_conn object.\n\nIf connection teardown races with an oplock break notification, the last\nconn reference can be dropped before the queued worker finishes.  The\nworker then uses the freed conn in ksmbd_conn_write() and\nksmbd_conn_r_count_dec().\n\nTake a real conn reference when publishing the conn pointer to the async\nwork item, and drop it after the notification work has decremented\nr_count.  Apply the same lifetime rule to lease break notification, which\nuses the same work-\u003econn pattern."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445 (and SMB-Direct); the oplock/lease break notification path is driven entirely by remote SMB2 CREATE/close traffic and connection teardown, so a remote peer reaches the freed-conn use over the network.\nAC:L - The attacker controls both sides of the race: one connection holds a batch oplock/lease while a second connection opens the same file to force the async break, and the first connection is then abruptly dropped so teardown passes the r_count wait before the increment lands; this can be retried across arbitrarily many connections.\nPR:N - ksmbd share access is commonly exposed with guest/anonymous mapping, so an unauthenticated or trivially-credentialed remote client can open files and trigger oplock/lease breaks; consistent with prior ksmbd connection-lifetime UAF scoring, no meaningful privilege gate protects this path.\nUI:N - No victim action is needed; the attacker\u0027s own two SMB connections create the oplock break and the racing disconnect entirely on their own initiative.\nS:U - The freed object and the corrupted state are both kernel memory owned by the ksmbd server within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free of struct ksmbd_conn lets the attacker reclaim the slab object with attacker-shaped data and have the worker read conn-\u003etransport and response state from it, enabling disclosure of kernel memory and pointer values, potentially leaked back over the SMB connection.\nI:H - ksmbd_conn_write() dereferences conn-\u003etransport-\u003eops-\u003ewritev from the freed object and indirectly calls it, and ksmbd_conn_lock()/ksmbd_conn_r_count_dec() perform mutex and atomic/waitqueue writes into freed memory, giving heap-spray-based control-flow hijack and arbitrary-write potential.\nA:H - Even without successful exploitation, using a freed ksmbd_conn (mutex operations, transport pointer dereference, waitqueue wakeup) reliably causes memory corruption, oops, or kernel panic, taking down the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:27.523Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f72fc9659d7f585460d43c158055df5afdcffb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/793e1c7041b93af96ff87e678329bc16aee7ba88"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ecb252efa0b413ac3d9979fb4eec247f8fc1258"
        },
        {
          "url": "https://git.kernel.org/stable/c/14062c74e5b25c27edcff7a2fe0dc701c930b372"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9"
        }
      ],
      "title": "ksmbd: pin conn during async oplock break notification",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68381",
    "datePublished": "2026-08-10T12:03:59.849Z",
    "dateReserved": "2026-07-30T09:28:09.387Z",
    "dateUpdated": "2026-08-17T05:04:27.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68381",
      "date": "2026-08-20",
      "epss": "0.00463",
      "percentile": "0.38486"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68381\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:31.197\",\"lastModified\":\"2026-08-17T06:17:46.560\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: pin conn during async oplock break notification\\n\\nsmb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn\\npointer in an async ksmbd_work and then queue that work on ksmbd-io.  The\\nwork only increments conn-\u003er_count, which prevents teardown from passing\\nthe pending-request wait after the increment, but it does not pin the\\nstruct ksmbd_conn object.\\n\\nIf connection teardown races with an oplock break notification, the last\\nconn reference can be dropped before the queued worker finishes.  The\\nworker then uses the freed conn in ksmbd_conn_write() and\\nksmbd_conn_r_count_dec().\\n\\nTake a real conn reference when publishing the conn pointer to the async\\nwork item, and drop it after the notification work has decremented\\nr_count.  Apply the same lifetime rule to lease break notification, which\\nuses the same work-\u003econn pattern.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/oplock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"09aeab68033161cb54f194da93e51a11aee6144b\",\"lessThan\":\"0f72fc9659d7f585460d43c158055df5afdcffb6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a4261bbc33fbf99b99c80aa3a2c5097611802980\",\"lessThan\":\"793e1c7041b93af96ff87e678329bc16aee7ba88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa660c059240e0c795217182cf7df32909dd917\",\"lessThan\":\"6ecb252efa0b413ac3d9979fb4eec247f8fc1258\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa660c059240e0c795217182cf7df32909dd917\",\"lessThan\":\"14062c74e5b25c27edcff7a2fe0dc701c930b372\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3aa660c059240e0c795217182cf7df32909dd917\",\"lessThan\":\"aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.84\",\"lessThan\":\"6.6.148\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.20\",\"lessThan\":\"6.12.101\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.13.8\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/oplock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f72fc9659d7f585460d43c158055df5afdcffb6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/14062c74e5b25c27edcff7a2fe0dc701c930b372\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6ecb252efa0b413ac3d9979fb4eec247f8fc1258\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/793e1c7041b93af96ff87e678329bc16aee7ba88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T07:15:47+00:00",
      "cve": "CVE-2026-68381",
      "id": "CVE-2026-68381",
      "initial_release_date": "2026-08-10T12:03:59.849000+00:00",
      "product_status:known_affected": "272",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: Use-after-free vulnerability due to race condition in connection handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68381.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-13T01:28:08Z",
      "cve": "CVE-2026-68381",
      "id": "CVE-2026-68381",
      "initial_release_date": "2026-08-12T16:22:29Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68381",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68381.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.