CVE-2026-23228 Overview
CVE-2026-23228 is a memory leak vulnerability [CWE-401] in the Linux kernel's ksmbd in-kernel SMB server. The flaw resides in the ksmbd_tcp_new_connection() function, where a failure of kthread_run() causes the transport to be released through free_transport(). That cleanup path does not decrement the active_num_conn counter, leaving the counter incremented for every failed connection attempt. Over time, the leaked counter can prevent clean module unload and disrupt SMB service availability on affected hosts.
Critical Impact
A local attacker with limited privileges can trigger repeated connection failures against the ksmbd SMB server, leaking the active_num_conn counter and causing availability impact on the kernel SMB service.
Affected Products
- Linux kernel 6.2 release candidates (rc6, rc7, rc8) and 6.2 GA
- Linux kernel stable branches containing ksmbd prior to the fix commits
- Distributions shipping ksmbd as the in-kernel SMB server
Discovery Timeline
- 2026-02-18 - CVE-2026-23228 published to NVD
- 2026-03-18 - Last updated in NVD database
Technical Details for CVE-2026-23228
Vulnerability Analysis
The ksmbd subsystem provides an in-kernel SMB3 server for Linux. When a new TCP connection is accepted, ksmbd_tcp_new_connection() allocates a transport structure and increments active_num_conn to track the number of live SMB connections. The function then spawns a kernel thread via kthread_run() to service the connection.
When kthread_run() fails, the original error path calls free_transport() to release the transport object. That helper frees memory but never decrements active_num_conn. The counter therefore drifts upward for every failed thread spawn. Because active_num_conn is consulted during shutdown and module teardown, a stuck counter blocks orderly cleanup of the ksmbd server.
The upstream fix replaces free_transport() with ksmbd_tcp_disconnect() on the failure path. ksmbd_tcp_disconnect() performs the matching decrement of active_num_conn in addition to freeing transport state, restoring counter balance.
Root Cause
The root cause is an unbalanced reference count [CWE-401]. The increment of active_num_conn on the success path of connection setup has no symmetric decrement on the kthread_run() failure path. The error handler used the wrong teardown helper, treating the partially initialized transport as if it had never been counted.
Attack Vector
Exploitation requires local access with low privileges and the ability to reach the ksmbd listener. An attacker triggers conditions that cause kthread_run() to fail, such as resource pressure that prevents kernel thread creation, while repeatedly initiating new SMB connections. Each failed setup leaks one count of active_num_conn, eventually preventing service shutdown and producing availability impact. The vulnerability does not affect confidentiality or integrity.
No exploit code is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.025%.
Detection Methods for CVE-2026-23228
Indicators of Compromise
- Repeated SMB connection failures in dmesg or journalctl originating from ksmbd-related kernel threads
- ksmbd module fails to unload with rmmod, reporting that the module is in use despite no active SMB sessions
- Kernel log entries indicating kthread_run() failures during SMB connection establishment
Detection Strategies
- Monitor the running Linux kernel version against the patched stable releases referenced in the upstream commits
- Audit hosts that load the ksmbd module and expose TCP port 445 to local users or containers
- Correlate kernel log warnings about thread creation failures with surges in inbound SMB connection attempts
Monitoring Recommendations
- Track the ksmbd connection count and compare against the number of authenticated SMB sessions to spot counter drift
- Alert on sustained SMB connection failure rates from a single local source, which may indicate a resource-exhaustion attempt
- Forward kernel logs and host telemetry to a centralized analytics platform to detect availability-impacting patterns across the fleet
How to Mitigate CVE-2026-23228
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the vendor advisories to all systems running ksmbd
- Restrict access to the SMB service to trusted networks and authenticated users only
- Unload the ksmbd module on hosts that do not require an in-kernel SMB server
Patch Information
The fix replaces free_transport() with ksmbd_tcp_disconnect() on the kthread_run() failure path in ksmbd_tcp_new_connection(), restoring the balanced decrement of active_num_conn. Patched commits are available in the upstream stable tree: Linux Kernel Commit 5992711, Linux Kernel Commit 6dd2645, Linux Kernel Commit 77ffbca, Linux Kernel Commit 787769c, Linux Kernel Commit 7ddd69c, Linux Kernel Commit baf664f, and Linux Kernel Commit cd25e0d. Consume the fix through your distribution's kernel update channel where possible.
Workarounds
- Disable ksmbd and use a userspace SMB server such as Samba on hosts that cannot be patched immediately
- Block inbound traffic to TCP port 445 at the host firewall when SMB service is not required
- Set kernel resource limits to reduce the likelihood of kthread_run() failures triggered by local resource pressure
# Disable and unload the ksmbd module where not required
sudo systemctl stop ksmbd.service 2>/dev/null
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/disable-ksmbd.conf
# Restrict SMB exposure at the host firewall
sudo nft add rule inet filter input tcp dport 445 drop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
