CVE-2026-52996: Linux Kernel Privilege Escalation Flaw

CVE-2026-52996 Overview

CVE-2026-52996 is a resource leak vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in parse_durable_handle_context() when handling DURABLE_REQ_V2 create contexts. When ksmbd_lookup_fd_cguid() locates an entry with a matching CreateGuid but a mismatched ClientGUID, the code falls through to the new-open path without releasing the reference obtained from ksmbd_fp_get(). Repeated requests that trigger this mismatch pin entries in the global file table, prevent __ksmbd_close_fd() from running, and defeat the durable handle scavenger.

Critical Impact
Remote SMB clients can trigger persistent kernel resource leaks by repeatedly sending durable v2 create requests with conflicting ClientGUID values, exhausting server file table capacity over time.

Affected Products

Linux kernel versions implementing ksmbd with durable handle v2 support
Distributions shipping vulnerable ksmbd builds prior to the upstream fix
Systems exposing ksmbd SMB shares to untrusted networks

Discovery Timeline

2026-06-24 - CVE-2026-52996 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52996

Vulnerability Analysis

The ksmbd module implements the SMB2/SMB3 protocol inside the Linux kernel. Durable handles allow SMB clients to reconnect to a previously opened file after a network interruption. The SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 create context carries a CreateGuid that uniquely identifies the open across reconnects.

When processing a durable v2 request, parse_durable_handle_context() calls ksmbd_lookup_fd_cguid() to search the global file table for an existing open with the same CreateGuid. That helper internally invokes ksmbd_fp_get(), which increments the refcount of the returned ksmbd_file structure. The caller is responsible for releasing that reference on every code path.

The ClientGUID-match branch correctly drops the reference via ksmbd_put_durable_fd() on failure paths or transfers ownership to dh_info->fp on a successful reconnect. The mismatch branch, however, falls through to the normal new-open execution without calling ksmbd_put_durable_fd(), leaking the reference.

Root Cause

The root cause is a missing reference decrement on a non-error control flow path. The lookup succeeded at the CreateGuid level, so a reference was acquired, but the subsequent ClientGUID comparison failed. Per MS-SMB2 section 3.3.5.9.10, this scenario is functionally equivalent to "Open not found," yet the side-effect reference from the lookup was never released. The leaked reference keeps the ksmbd_file and its global_ft entry alive indefinitely.

Attack Vector

An authenticated SMB client repeatedly issues CREATE requests carrying a SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 context whose CreateGuid collides with an existing open but whose connection ClientGUID differs. Each such request leaks one ksmbd_file reference. Over time, the global file table accumulates unreclaimable entries, defeating the durable scavenger and producing long-lived kernel memory and file descriptor leaks.

The upstream fix releases the reference in the mismatch branch and clears dh_info->fp so subsequent logic does not treat the non-matching lookup result as a reconnect target. See the Linux Kernel Commit 06f709d for the patch.

Detection Methods for CVE-2026-52996

Indicators of Compromise

Sustained growth of ksmbd-related kernel slab allocations without corresponding session activity
Increasing number of entries in the ksmbd global file table that are not reaped by the durable scavenger
SMB clients sending repeated CREATE requests with identical CreateGuid values but rotating ClientGUID values

Detection Strategies

Monitor slabtop and /proc/slabinfo for unbounded growth in ksmbd_file and related caches
Capture SMB traffic and correlate CreateGuid and ClientGuid fields within SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 contexts to flag mismatched pairings
Alert on kernel log entries from ksmbd indicating elevated open counts or scavenger inactivity

Monitoring Recommendations

Track memory utilization on hosts running ksmbd and baseline normal durable handle counts
Log all SMB sessions and create-context payloads at network sensors to enable retrospective analysis
Review uptime of ksmbd services and schedule restarts if leak indicators appear before patches can be deployed

How to Mitigate CVE-2026-52996

Immediate Actions Required

Apply the upstream Linux kernel patches referenced below as soon as vendor builds are available
Restrict ksmbd exposure to trusted networks via firewall rules on TCP port 445
Disable ksmbd on hosts where SMB serving is not required

Patch Information

The fix was committed to the Linux kernel stable trees. Apply the kernel build that contains one of the following commits:

The patch adds the missing ksmbd_put_durable_fd() call on the ClientGUID mismatch path and clears dh_info->fp to prevent subsequent logic from treating the result as a reconnect target.

Workarounds

Unload the ksmbd kernel module and use an alternative SMB server such as Samba smbd until patches are deployed
Require SMB authentication and limit access to known client IP ranges to reduce attack surface
Periodically restart the ksmbd service to reclaim leaked file table entries as an interim measure

bash

# Disable ksmbd as a temporary workaround
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd

# Verify the module is unloaded
lsmod | grep ksmbd