CVE-2026-43379: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43379 Overview

CVE-2026-43379 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw lives in smb_lazy_parent_lease_break_close(), where an opinfo pointer obtained through rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock() has already been called. A concurrent writer can free the underlying memory between the unlock and the subsequent access to fields such as opinfo->is_lease, producing a classic Read-Copy-Update (RCU) lifetime violation. Because ksmbd processes untrusted SMB traffic from the network, the race is reachable by remote clients that can establish SMB sessions against a vulnerable server.

Critical Impact
Remote attackers able to reach an exposed ksmbd service can trigger memory corruption that may lead to kernel crashes or arbitrary code execution in kernel context.

Affected Products

Linux kernel versions containing the ksmbd SMB server with the lazy parent lease break logic
Distributions shipping ksmbd as an in-kernel SMB3 server prior to the upstream stable fixes
Systems exposing ksmbd to untrusted networks

Discovery Timeline

2026-05-08 - CVE-2026-43379 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43379

Vulnerability Analysis

The ksmbd module implements SMB3 lease break handling for open files. The function smb_lazy_parent_lease_break_close() retrieves an oplock information structure with rcu_dereference(fp->f_opinfo) inside an RCU read-side critical section. The code then calls rcu_read_unlock() but continues to access fields on the previously obtained opinfo pointer. Once rcu_read_unlock() returns, the RCU grace period can complete and a concurrent writer can free the opinfo object. Any subsequent dereference, including the read of opinfo->is_lease, operates on freed memory.

Root Cause

The defect is an RCU lifetime violation. RCU only guarantees that an object remains valid for the duration of the read-side critical section bounded by rcu_read_lock() and rcu_read_unlock(). The original code violated this contract by extending pointer use past the unlock without taking a separate reference on the object. This is a Use-After-Free condition rooted in incorrect synchronization rather than allocator misuse.

Attack Vector

Exploitation requires network reachability to the ksmbd service and the ability to drive concurrent SMB operations that trigger oplock or lease state transitions on the same file. An attacker schedules an operation that releases the parent lease in parallel with a close path that traverses smb_lazy_parent_lease_break_close(), racing the writer that frees opinfo against the post-unlock reads. Successful races result in dereferencing freed kernel memory, which can yield denial of service through panic or, with shaped heap state, controlled kernel memory corruption.

The vulnerability mechanism is described in the upstream commits referenced below. See the Linux Kernel Commit eac3361e and the Linux Kernel Commit bf4d66d7 for the corrected synchronization logic.

Detection Methods for CVE-2026-43379

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN: use-after-free reports referencing smb_lazy_parent_lease_break_close or ksmbd symbols in dmesg
Repeated SMB session resets or service crashes on hosts running ksmbd
Anomalous bursts of concurrent SMB2 CLOSE and LEASE_BREAK requests from a single client

Detection Strategies

Enable KASAN on test kernels and review boot logs for use-after-free traces in ksmbd code paths
Audit running kernels for the ksmbd module and compare versions against the fixed stable releases
Correlate SMB protocol telemetry with kernel log events to identify clients triggering lease break races

Monitoring Recommendations

Forward /var/log/kern.log and dmesg output to a centralized logging system and alert on ksmbd stack traces
Monitor TCP port 445 for unexpected external exposure on Linux hosts using network flow data
Track ksmbd.mountd process restarts and service availability as a proxy for kernel-side failures

How to Mitigate CVE-2026-43379

Immediate Actions Required

Apply the upstream stable kernel updates that include the smb_lazy_parent_lease_break_close() fix as soon as vendor packages are available
Restrict access to TCP port 445 on Linux hosts running ksmbd to trusted management networks only
Disable the ksmbd service on systems that do not require an SMB server using systemctl disable --now ksmbd

Patch Information

The issue is resolved by ensuring the opinfo pointer is only accessed inside the RCU read-side critical section or by acquiring a reference before unlocking. Stable tree fixes are available in the following commits: Linux Kernel Commit 9606993, Linux Kernel Commit b3568347, Linux Kernel Commit bf4d66d7, Linux Kernel Commit dbbd328c, and Linux Kernel Commit eac3361e. Rebuild and reboot into the patched kernel to activate the fix.

Workarounds

Unload the ksmbd module with modprobe -r ksmbd on hosts that do not require SMB services
Block inbound TCP 445 at the host firewall using nftables or iptables until the patched kernel is deployed
Limit SMB clients to authenticated, internal users and disable guest access in ksmbd.conf

bash

# Configuration example: block external SMB access and disable ksmbd
sudo systemctl stop ksmbd
sudo systemctl disable ksmbd
sudo modprobe -r ksmbd
sudo nft add rule inet filter input tcp dport 445 drop