CVE-2026-23428: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23428 Overview

CVE-2026-23428 is a use-after-free vulnerability in the Linux kernel's ksmbd (in-kernel SMB server) component. The vulnerability exists in the handling of compound SMB2 requests, where smb2_get_ksmbd_tcon() reuses the work->tcon structure without properly validating the tcon->t_state field. This allows a specially crafted compound request to trigger a use-after-free condition when accessing share_conf after it has been freed by a preceding tree disconnect operation.

Critical Impact

Attackers can exploit this use-after-free vulnerability in the Linux kernel's ksmbd SMB server to potentially achieve arbitrary code execution or cause a denial of service condition by sending malicious compound SMB2 requests.

Affected Products

• Linux kernel with ksmbd (in-kernel SMB server) enabled
• Systems running ksmbd with compound SMB2 request processing
• Multiple Linux kernel versions prior to the security patches

Discovery Timeline

• April 3, 2026 - CVE CVE-2026-23428 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23428

Vulnerability Analysis

This use-after-free vulnerability occurs in the ksmbd SMB server's compound request handling logic. The core issue lies in the smb2_get_ksmbd_tcon() function, which is responsible for retrieving the tree connection context during SMB2 operations.

Under normal operation, ksmbd_tree_conn_lookup() performs a state validation check to ensure that t_state == TREE_CONNECTED before processing requests. However, when handling compound requests (multiple SMB2 commands bundled together), the function takes a shortcut by reusing the previously cached work->tcon pointer without re-validating the connection state.

This creates a dangerous race condition when a compound request contains an SMB2_TREE_DISCONNECT command followed by subsequent commands that reference the same tree connection. The disconnect command sets t_state to TREE_DISCONNECTED and calls ksmbd_share_config_put(), which frees the share_conf structure. Subsequent commands in the compound request then dereference the already-freed share_conf through work->tcon->share_conf, resulting in a use-after-free condition.

The KASAN (Kernel Address Sanitizer) report included in the vulnerability disclosure confirms this behavior, showing a slab-use-after-free error in smb2_write() when reading from a freed 96-byte memory region in the kmalloc-96 cache.

Root Cause

The root cause is a missing state validation check in the compound request reuse path within smb2_get_ksmbd_tcon(). While the initial lookup path properly validates tcon->t_state, the compound request optimization path bypasses this critical security check entirely. This allows operations to proceed on a tree connection that has already been disconnected and had its associated resources freed.

Attack Vector

An attacker with network access to a ksmbd SMB server can exploit this vulnerability by sending a specially crafted compound SMB2 request. The attack sequence would involve:

1. Establishing a valid tree connection to the SMB server
2. Constructing a compound SMB2 request containing multiple chained commands
3. Including an SMB2_TREE_DISCONNECT command early in the compound sequence
4. Following with additional commands (such as SMB2_WRITE) that reference the same tree connection
5. The disconnect command frees share_conf while subsequent commands attempt to access it through the stale work->tcon pointer

The vulnerability is exploitable remotely over the network through the SMB protocol, making it accessible to any authenticated user with basic file sharing permissions.

Detection Methods for CVE-2026-23428

Indicators of Compromise

• Kernel crash or panic messages referencing smb2_write, handle_ksmbd_work, or ksmbd-io workqueue
• KASAN reports indicating slab-use-after-free in ksmbd-related functions
• Unusual compound SMB2 request patterns in network traffic containing tree disconnect operations

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) in development/test environments to detect use-after-free conditions
• Monitor kernel logs for crash dumps or oops messages originating from ksmbd worker threads
• Deploy network intrusion detection rules to identify malformed or suspicious compound SMB2 request sequences
• Audit SMB server logs for unusual tree connect/disconnect patterns within rapid succession

Monitoring Recommendations

• Configure kernel crash dump collection (kdump) to capture diagnostic information if exploitation occurs
• Enable enhanced SMB audit logging to track compound request processing
• Monitor for abnormal ksmbd worker thread behavior or resource consumption patterns

How to Mitigate CVE-2026-23428

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• If patching is not immediately possible, consider disabling ksmbd and using userspace Samba instead
• Restrict network access to SMB services to trusted networks only
• Monitor ksmbd-enabled systems for signs of exploitation attempts

Patch Information

The Linux kernel developers have released patches to address this vulnerability. The fix involves adding proper t_state validation in the compound request reuse path to ensure that disconnected tree connections are not accessed. Multiple kernel stable branches have received the fix:

• Linux Kernel Commit 7f7468f
• Linux Kernel Commit 806f137
• Linux Kernel Commit a5929c2
• Linux Kernel Commit c33615f
• Linux Kernel Commit c742b46
• Linux Kernel Commit eae0dc8

Workarounds

• Disable ksmbd kernel module and use userspace Samba (smbd) as an alternative SMB server
• Implement network-level access controls to restrict SMB access to trusted clients only
• Deploy firewall rules to block SMB traffic (ports 445/tcp and 139/tcp) from untrusted networks

# Disable ksmbd kernel module
sudo modprobe -r ksmbd
sudo echo "blacklist ksmbd" >> /etc/modprobe.d/blacklist.conf

# Restrict SMB access via firewall (iptables example)
sudo iptables -A INPUT -p tcp --dport 445 -s trusted_network/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP