CVE-2026-23427: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23427 Overview

A use-after-free vulnerability has been discovered in the Linux kernel's ksmbd (SMB3 server) component. The flaw exists in the parse_durable_handle_context() function, which unconditionally assigns dh_info->fp->conn to the current connection when handling a DURABLE_REQ_V2 context with SMB2_FLAGS_REPLAY_OPERATION. Since ksmbd_lookup_fd_cguid() does not filter by fp->conn, it returns file handles that are already actively connected. The unconditional overwrite replaces fp->conn, and when the overwriting connection is subsequently freed, __ksmbd_close_fd() dereferences the stale fp->conn pointer via spin_lock(&fp->conn->llist_lock), causing a use-after-free condition.

Critical Impact

This vulnerability allows attackers to trigger a use-after-free condition through SMB2 durable handle replay operations, potentially leading to kernel memory corruption, denial of service, or privilege escalation on affected Linux systems running ksmbd.

Affected Products

• Linux kernel with ksmbd (SMB3 server) enabled
• Systems using DURABLE_REQ_V2 context with SMB2_FLAGS_REPLAY_OPERATION

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-23427 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-23427

Vulnerability Analysis

This use-after-free vulnerability occurs within the ksmbd SMB3 server implementation in the Linux kernel. The root issue lies in the improper handling of durable file handle reconnection during SMB2 replay operations.

When processing a DURABLE_REQ_V2 context with the SMB2_FLAGS_REPLAY_OPERATION flag set, the parse_durable_handle_context() function performs an unconditional assignment of the current connection to the file handle's connection pointer (dh_info->fp->conn). This assignment happens without proper validation of whether the file handle is already associated with an active connection.

The KASAN (Kernel Address Sanitizer) report included in the vulnerability disclosure clearly demonstrates the memory corruption pattern. The stack trace shows that after the connection is freed via ksmbd_tcp_disconnect(), a subsequent call to __ksmbd_close_fd() attempts to acquire a spinlock on the stale connection pointer, triggering the use-after-free when accessing fp->conn->llist_lock.

The vulnerability affects the kmalloc-1k slab cache, with the stale pointer access occurring 396 bytes into a freed 1024-byte memory region. This indicates that exploitation could potentially corrupt other kernel memory allocations in the same slab, increasing the severity of the vulnerability.

Root Cause

The root cause is a missing connection validation check in ksmbd_lookup_fd_cguid(). This function fails to filter file handles by their associated connection (fp->conn), allowing it to return file handles that are already actively connected to different sessions. Combined with the unconditional connection pointer overwrite in parse_durable_handle_context(), this creates a race condition where connection pointers become stale after the original connection is freed.

Attack Vector

An attacker can exploit this vulnerability by sending crafted SMB2 requests with DURABLE_REQ_V2 contexts and SMB2_FLAGS_REPLAY_OPERATION flags to a ksmbd server. The attack involves:

1. Establishing an initial SMB connection and creating a durable file handle
2. Initiating a second connection with a replay operation targeting the same file handle GUID
3. Disconnecting the second connection to free its connection structure
4. Triggering operations on the original file handle that reference the now-freed connection pointer

The vulnerability manifests in the parse_durable_handle_context() function where the connection pointer is unconditionally overwritten. When the overwriting connection is subsequently freed, any subsequent operation that dereferences fp->conn will access freed memory. Technical details can be found in the Linux Kernel Commit 568a25f.

Detection Methods for CVE-2026-23427

Indicators of Compromise

• KASAN reports indicating slab-use-after-free in _raw_spin_lock related to ksmbd workqueue operations
• Kernel crash dumps showing corruption in kmalloc-1k slab cache with ksmbd-related stack traces
• Unusual SMB2 connection patterns with rapid DURABLE_REQ_V2 replay requests
• System instability or crashes in handle_ksmbd_work workqueue threads

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) in kernel builds to detect use-after-free conditions at runtime
• Monitor kernel logs for BUG reports related to ksmbd, particularly those mentioning __ksmbd_close_fd or spin_lock operations
• Implement network-level monitoring for anomalous SMB2_FLAGS_REPLAY_OPERATION patterns
• Deploy file integrity monitoring on ksmbd configuration and related kernel modules

Monitoring Recommendations

• Configure real-time alerting for kernel oops or panic events involving ksmbd components
• Monitor SMB connection metrics for unusual patterns of rapid connect/disconnect cycles
• Enable kernel debugging features on non-production systems to capture detailed crash information
• Implement network traffic analysis to detect potential exploitation attempts targeting SMB3 durable handles

How to Mitigate CVE-2026-23427

Immediate Actions Required

• Apply the latest kernel patches that address this vulnerability from the official kernel.org stable branches
• Consider disabling the ksmbd module if SMB3 server functionality is not required (modprobe -r ksmbd)
• Use Samba instead of ksmbd as an alternative SMB server implementation until patches are applied
• Restrict network access to SMB services using firewall rules to trusted networks only

Patch Information

Multiple patches have been committed to address this vulnerability across different kernel branches. The fix adds proper connection validation to ksmbd_lookup_fd_cguid() and ensures that file handle connection pointers are not unconditionally overwritten during replay operations.

Relevant kernel commits include:

• Linux Kernel Commit 568a25f
• Linux Kernel Commit 9b0792c
• Linux Kernel Commit a5828c1
• Linux Kernel Commit b0158d9
• Linux Kernel Commit b425e4d

Workarounds

• Disable the ksmbd kernel module if in-kernel SMB3 server is not required for operations
• Deploy network segmentation to limit SMB3 access to trusted internal networks only
• Use Samba userspace SMB server as an alternative to ksmbd until kernel patches are applied
• Implement strict access controls and authentication requirements for SMB connections

# Disable ksmbd module temporarily
modprobe -r ksmbd

# Blacklist ksmbd to prevent loading on boot
echo "blacklist ksmbd" >> /etc/modprobe.d/blacklist-ksmbd.conf

# Block SMB ports from untrusted networks (adjust as needed)
iptables -A INPUT -p tcp --dport 445 -s ! 10.0.0.0/8 -j DROP