CVE-2026-45924: Linux Kernel Privilege Escalation Bug

CVE-2026-45924 Overview

CVE-2026-45924 is a Linux kernel vulnerability in the ksmbd in-kernel SMB3 server. The flaw resides in error-handling logic that fails to call ksmbd_vfs_kern_path_end_removing() on certain return paths. This omission leaves inode locks held and reference counts unbalanced after a successful call to ksmbd_vfs_kern_path_start_removing(). The defect was discovered by the Linux Verification Center (linuxtesting.org) and resolved upstream. Affected systems can experience deadlocks and leaked locks within the ksmbd-io workqueue when processing SMB requests.

Critical Impact
Remote SMB clients can trigger workqueue lock leaks and potential deadlocks in the kernel ksmbd service, leading to denial of service on file servers that expose SMB shares.

Affected Products

Linux kernel builds with CONFIG_SMB_SERVER (ksmbd) enabled
Stable kernel branches referenced by the fix commits (multiple LTS lines)
Distributions and appliances shipping ksmbd-based SMB file sharing

Discovery Timeline

2026-05-27 - CVE-2026-45924 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45924

Vulnerability Analysis

The vulnerability is a locking and reference-counting imbalance [CWE-667] in the ksmbd virtual filesystem helper layer. ksmbd_vfs_kern_path_start_removing() acquires sb_writers and the parent directory i_mutex lock, and takes path references prior to a removal operation. Each successful call must be paired with ksmbd_vfs_kern_path_end_removing() to release those locks and references.

Two error paths in the original code returned without invoking the end helper. When those branches were taken, the kernel left locks held when the work item completed. The kernel's workqueue infrastructure detects this and emits BUG: workqueue leaked lock or atomic for the handle_ksmbd_work worker. Continued execution against the held i_mutex_dir_key lock can deadlock concurrent filesystem operations.

Root Cause

The root cause is incomplete cleanup in ksmbd request handlers. The function ksmbd_vfs_kern_path_locked and its callers branch to error returns without releasing the locks acquired earlier in the sequence. The fix adds the missing ksmbd_vfs_kern_path_end_removing() calls to balance every successful start, restoring correct lock-acquire/release pairing.

Attack Vector

The attack vector is network-based through the SMB protocol. An authenticated SMB client can issue request sequences that drive ksmbd into the affected error branches. Repeated triggering exhausts workqueue capacity and locks shared filesystem structures, producing denial of service on the file server. No verified public exploit is currently available for this issue.

No verified exploit code is available. See the upstream commits for the technical fix details: Kernel Git Commit a09dc10d13 and Kernel Git Commit cf29329a13.

Detection Methods for CVE-2026-45924

Indicators of Compromise

Kernel log entries containing BUG: workqueue leaked lock or atomic referencing handle_ksmbd_work.
Stack traces in dmesg showing ksmbd_vfs_kern_path_locked followed by process_one_work and worker_thread frames.
Hung tasks or processes blocked on sb_writers or i_mutex_dir_key locks tied to SMB share filesystems.

Detection Strategies

Monitor dmesg and /var/log/kern.log for workqueue lock leak warnings tied to the ksmbd-io workqueue.
Alert on khungtaskd warnings or INFO: task ... blocked for more than N seconds messages on hosts running ksmbd.
Track SMB session abnormalities such as clients receiving repeated request timeouts against a previously healthy share.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging or SIEM platform and create rules for ksmbd stack traces.
Baseline ksmbd-io workqueue concurrency and alert on sustained worker exhaustion.
Audit running kernel versions across the fleet to identify hosts still on vulnerable builds exposing SMB.

How to Mitigate CVE-2026-45924

Immediate Actions Required

Apply the upstream kernel patches that add the missing ksmbd_vfs_kern_path_end_removing() calls on all hosts running ksmbd.
If patching is not immediately possible, disable the ksmbd module and use an alternative SMB server such as Samba smbd until updates are deployed.
Restrict SMB exposure to trusted network segments and require authenticated, least-privileged access to shares.

Patch Information

The fix is distributed across multiple stable kernel commits. Reference commits include Kernel Git Commit 0c578e8065, Kernel Git Commit 34d6691933, Kernel Git Commit 4c38600feb, Kernel Git Commit 8e3a3192ef, Kernel Git Commit a09dc10d13, Kernel Git Commit cf29329a13, and Kernel Git Commit f221baa80e. Update to a distribution kernel that incorporates these backports.

Workarounds

Unload the ksmbd module with modprobe -r ksmbd and blacklist it until the patched kernel is available.
Block inbound TCP port 445 at perimeter and host firewalls where SMB service is not required.
Replace ksmbd with user-space Samba on affected hosts that must continue serving SMB.

bash

# Disable ksmbd until patched kernel is installed
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB at the host firewall (example: nftables)
sudo nft add rule inet filter input tcp dport 445 drop