CVE-2026-23428: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23428 Overview

CVE-2026-23428 is a use-after-free vulnerability in the Linux kernel's ksmbd (in-kernel SMB server) component. The vulnerability exists in the handling of compound SMB2 requests, where smb2_get_ksmbd_tcon() reuses the work->tcon structure without properly validating the tcon->t_state field. This allows a specially crafted compound request to trigger a use-after-free condition when accessing share_conf after it has been freed by a preceding tree disconnect operation.

Critical Impact
Attackers can exploit this use-after-free vulnerability in the Linux kernel's ksmbd SMB server to potentially achieve arbitrary code execution or cause a denial of service condition by sending malicious compound SMB2 requests.

Affected Products

Linux kernel with ksmbd (in-kernel SMB server) enabled
Systems running ksmbd with compound SMB2 request processing
Multiple Linux kernel versions prior to the security patches

Discovery Timeline

April 3, 2026 - CVE CVE-2026-23428 published to NVD
April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23428

Vulnerability Analysis

This use-after-free vulnerability occurs in the ksmbd SMB server's compound request handling logic. The core issue lies in the smb2_get_ksmbd_tcon() function, which is responsible for retrieving the tree connection context during SMB2 operations.

Under normal operation, ksmbd_tree_conn_lookup() performs a state validation check to ensure that t_state == TREE_CONNECTED before processing requests. However, when handling compound requests (multiple SMB2 commands bundled together), the function takes a shortcut by reusing the previously cached work->tcon pointer without re-validating the connection state.

This creates a dangerous race condition when a compound request contains an SMB2_TREE_DISCONNECT command followed by subsequent commands that reference the same tree connection. The disconnect command sets t_state to TREE_DISCONNECTED and calls ksmbd_share_config_put(), which frees the share_conf structure. Subsequent commands in the compound request then dereference the already-freed share_conf through work->tcon->share_conf, resulting in a use-after-free condition.

The KASAN (Kernel Address Sanitizer) report included in the vulnerability disclosure confirms this behavior, showing a slab-use-after-free error in smb2_write() when reading from a freed 96-byte memory region in the kmalloc-96 cache.

Root Cause

The root cause is a missing state validation check in the compound request reuse path within smb2_get_ksmbd_tcon(). While the initial lookup path properly validates tcon->t_state, the compound request optimization path bypasses this critical security check entirely. This allows operations to proceed on a tree connection that has already been disconnected and had its associated resources freed.

Attack Vector

An attacker with network access to a ksmbd SMB server can exploit this vulnerability by sending a specially crafted compound SMB2 request. The attack sequence would involve:

Establishing a valid tree connection to the SMB server
Constructing a compound SMB2 request containing multiple chained commands
Including an SMB2_TREE_DISCONNECT command early in the compound sequence
Following with additional commands (such as SMB2_WRITE) that reference the same tree connection
The disconnect command frees share_conf while subsequent commands attempt to access it through the stale work->tcon pointer

The vulnerability is exploitable remotely over the network through the SMB protocol, making it accessible to any authenticated user with basic file sharing permissions.

Detection Methods for CVE-2026-23428

Indicators of Compromise

Kernel crash or panic messages referencing smb2_write, handle_ksmbd_work, or ksmbd-io workqueue
KASAN reports indicating slab-use-after-free in ksmbd-related functions
Unusual compound SMB2 request patterns in network traffic containing tree disconnect operations

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in development/test environments to detect use-after-free conditions
Monitor kernel logs for crash dumps or oops messages originating from ksmbd worker threads
Deploy network intrusion detection rules to identify malformed or suspicious compound SMB2 request sequences
Audit SMB server logs for unusual tree connect/disconnect patterns within rapid succession

Monitoring Recommendations

Configure kernel crash dump collection (kdump) to capture diagnostic information if exploitation occurs
Enable enhanced SMB audit logging to track compound request processing
Monitor for abnormal ksmbd worker thread behavior or resource consumption patterns

How to Mitigate CVE-2026-23428

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix
If patching is not immediately possible, consider disabling ksmbd and using userspace Samba instead
Restrict network access to SMB services to trusted networks only
Monitor ksmbd-enabled systems for signs of exploitation attempts

Patch Information

The Linux kernel developers have released patches to address this vulnerability. The fix involves adding proper t_state validation in the compound request reuse path to ensure that disconnected tree connections are not accessed. Multiple kernel stable branches have received the fix:

Workarounds

Disable ksmbd kernel module and use userspace Samba (smbd) as an alternative SMB server
Implement network-level access controls to restrict SMB access to trusted clients only
Deploy firewall rules to block SMB traffic (ports 445/tcp and 139/tcp) from untrusted networks

bash

# Disable ksmbd kernel module
sudo modprobe -r ksmbd
sudo echo "blacklist ksmbd" >> /etc/modprobe.d/blacklist.conf

# Restrict SMB access via firewall (iptables example)
sudo iptables -A INPUT -p tcp --dport 445 -s trusted_network/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP