CVE-2022-47939: Linux Kernel Use-After-Free Vulnerability

CVE-2022-47939 Overview

CVE-2022-47939 is a use-after-free vulnerability in ksmbd, the in-kernel SMB3 server shipped with Linux kernel versions 5.15 through 5.19 (fixed in 5.19.2). The flaw resides in fs/ksmbd/smb2pdu.c and is triggered during processing of SMB2_TREE_DISCONNECT requests. Successful exploitation can produce a kernel OOPS and, under the right conditions, arbitrary code execution in kernel context. Because ksmbd listens on the network and the bug is reachable before any authenticated session is fully torn down, the attack surface is exposed to remote, unauthenticated clients on hosts that enable the module.

Critical Impact
Remote, unauthenticated attackers can trigger a use-after-free in the Linux kernel ksmbd module, leading to denial of service or potential remote code execution at kernel privilege.

Affected Products

Linux kernel 5.15 (with ksmbd enabled)
Linux kernel 5.16 through 5.18
Linux kernel 5.19 before 5.19.2

Discovery Timeline

2022-12-23 - CVE-2022-47939 published to NVD
2025-04-14 - Last updated in NVD database

Technical Details for CVE-2022-47939

Vulnerability Analysis

The vulnerability lives in the ksmbd server's handler for the SMB2_TREE_DISCONNECT command. ksmbd is an SMB3 file server that runs inside the Linux kernel and was introduced as an alternative to the userspace Samba daemon. When a client issues a tree disconnect, the handler tears down the tree connection (tcon) associated with the session and frees the related state. The handler did not clear the work->tcon pointer after disconnecting, leaving a dangling reference to freed memory [CWE-416].

A concurrent or subsequent request that reuses the same ksmbd_work structure can dereference work->tcon, operating on freed kernel memory. This produces an immediate kernel OOPS in the safe path and creates a window for memory reuse that an attacker can shape to corrupt kernel objects. Because the vulnerable code path executes before tree-connect authentication state is validated by subsequent commands, the bug is reachable over the network without credentials.

Root Cause

The defect is a missing pointer invalidation. After ksmbd_tree_conn_disconnect() frees the tcon object, the per-request work->tcon field still references the freed structure. Any later access to that pointer constitutes a use-after-free.

Attack Vector

An attacker reaches the bug by sending crafted SMB2 traffic to TCP port 445 on a host that has loaded ksmbd and exposed a share. No authentication or user interaction is required. The handler can be entered in racing or repeated sequences that exercise the freed tcon pointer, causing a crash or memory corruption.

// Upstream fix in fs/ksmbd/smb2pdu.c
// ksmbd: fix use-after-free bug in smb2_tree_disconect
 	ksmbd_close_tree_conn_fds(work);
 	ksmbd_tree_conn_disconnect(sess, tcon);
+	work->tcon = NULL;
 	return 0;
 }

Source: Linux Kernel Commit cf6531d. The patch sets work->tcon = NULL after the disconnect, preventing later code paths from dereferencing the freed object.

Detection Methods for CVE-2022-47939

Indicators of Compromise

Kernel OOPS or general protection fault entries in dmesg referencing smb2_tree_disconnect or ksmbd_tree_conn_disconnect.
Unexpected ksmbd worker thread crashes followed by SMB service degradation.
Inbound TCP/445 connections from unusual external sources to hosts running ksmbd.

Detection Strategies

Inventory Linux hosts running kernels 5.15 through 5.19 and check whether the ksmbd module is loaded with lsmod | grep ksmbd.
Correlate kernel ring buffer crash signatures (KASAN: use-after-free if KASAN is enabled) with SMB connection logs from the same timeframe.
Use network sensors to identify SMB2 TREE_DISCONNECT floods or anomalous tree-connect/disconnect sequences from a single source.

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a central log platform and alert on ksmbd stack traces.
Monitor TCP/445 exposure on Linux servers; alert when ksmbd listens on an interface reachable from untrusted networks.
Track kernel package versions across the fleet and flag any host running a vulnerable 5.15–5.19 build.

How to Mitigate CVE-2022-47939

Immediate Actions Required

Upgrade affected systems to Linux kernel 5.19.2 or later, or apply the distribution's backported fix.
If patching is not immediately possible, unload the module with modprobe -r ksmbd and prevent autoload by blacklisting it.
Restrict TCP/445 at the host firewall and perimeter so only trusted management networks can reach ksmbd.

Patch Information

The fix is upstream commit cf6531d98190fa2cf92a6d8bbc8af0a4740a223c, included in the Linux Kernel ChangeLog 5.19.2. The patch sets work->tcon = NULL after ksmbd_tree_conn_disconnect() to eliminate the dangling reference. Distribution vendors have shipped equivalent backports; consult your vendor's advisory and rebuild or reboot to load the corrected kernel. Additional context is available in ZDI-22-1690 and the SecPod analysis.

Workarounds

Disable ksmbd and use userspace Samba (smbd) for SMB file sharing until the kernel is patched.
Add a blacklist entry in /etc/modprobe.d/ to prevent ksmbd from loading on boot.
Limit SMB exposure with iptables/nftables rules that drop inbound 445/TCP from untrusted ranges.

bash

# Prevent ksmbd from loading and block SMB from untrusted networks
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/disable-ksmbd.conf
sudo iptables -A INPUT -p tcp --dport 445 ! -s 10.0.0.0/8 -j DROP