CVE-2026-53010: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53010 Overview

CVE-2026-53010 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the smb2_open function and is triggered during the durable file handle reconnect process. The kernel patch description explains that ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor too early. If a subsequent error path executes, such as ksmbd_iov_pin_rsp failing, or a scavenger thread accesses the file, the code references freed memory through fp properties like fp->create_time.

Critical Impact
An attacker reachable over SMB can trigger memory corruption in kernel space through the durable reconnect path, potentially leading to denial of service or kernel-level code execution.

Affected Products

Linux kernel versions containing the affected ksmbd durable file handle implementation
Systems exposing ksmbd SMB3 server functionality to networks
Distributions shipping the unpatched fs/smb/server/smb2pdu.c code path

Discovery Timeline

2026-06-24 - CVE-2026-53010 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53010

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the ksmbd kernel module, which implements an SMB3 file server inside the Linux kernel. The smb2_open handler processes SMB2 CREATE requests, including reconnections to durable file handles that survived a session disconnect. During a durable reconnect, the code retrieves a file pointer fp and calls ksmbd_put_durable_fd(fp) to decrement its reference count.

Releasing the durable reference early creates a window where fp may be freed by another path while smb2_open continues executing. If ksmbd_iov_pin_rsp fails or the scavenger thread, which reaps expired durable handles, runs concurrently, the object backing fp can be reclaimed. The handler then dereferences freed memory when accessing fields such as fp->create_time, leading to undefined kernel behavior.

The EPSS score for this issue is 0.166% at the 6.129 percentile, reflecting limited public exploitation signal at the time of publication.

Root Cause

The root cause is incorrect lifetime management of the durable file descriptor reference. The original code placed ksmbd_put_durable_fd(fp) before the function's error-handling tail, so any failure or concurrent scavenger run after that point operated on a pointer whose backing object could already be freed. The fix moves the single put operation past the err_out2 label, ensuring fp remains valid until smb2_open returns.

Attack Vector

The attack surface is the SMB2/SMB3 protocol exposed by ksmbd. An authenticated remote client capable of issuing SMB2 CREATE requests with durable handle context can attempt to reconnect to a durable file ID and race the server's error or scavenger paths. Triggering the use-after-free does not require local code execution on the target. Systems exposing ksmbd to untrusted networks face the greatest risk.

No verified proof-of-concept code is published for CVE-2026-53010. Refer to the upstream commits for the precise code path: Kernel Git Commit 1baff47, Kernel Git Commit 97a0cd5, and Kernel Git Commit ce2e164.

Detection Methods for CVE-2026-53010

Indicators of Compromise

Kernel oops or panic stack traces referencing smb2_open, ksmbd_put_durable_fd, or ksmbd_iov_pin_rsp in dmesg or journalctl -k output.
KASAN reports identifying use-after-free conditions inside the ksmbd module on hosts that have KASAN enabled.
Unexpected ksmbd.mountd or kernel thread crashes correlated with bursts of SMB2 CREATE requests using durable handle contexts.

Detection Strategies

Monitor kernel log subsystems for ksmbd-tagged warnings, BUG, or general protection fault entries following SMB reconnect activity.
Inspect SMB traffic for repeated CREATE requests carrying DH2C (durable handle reconnect v2) or DHnC create contexts from a single source.
Audit /proc/fs/ksmbd/ statistics and session tables for abnormal churn in durable handle counts.

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on ksmbd crash signatures.
Capture SMB2 protocol metadata at network choke points to baseline durable handle usage and flag anomalies.
Track patch level of the kernel package across the fleet and alert when hosts running ksmbd lag the fixed version.

How to Mitigate CVE-2026-53010

Immediate Actions Required

Apply the upstream kernel patches that move ksmbd_put_durable_fd(fp) past the err_out2 label in smb2_open.
Restrict network reachability of ksmbd to trusted client segments using host firewalls and network ACLs on TCP/445.
If ksmbd is not actively required, unload the module with modprobe -r ksmbd and disable the ksmbd.service unit.

Patch Information

The fix is committed in the stable Linux kernel tree. Rebuild or update to a kernel that includes Kernel Git Commit 1baff47, Kernel Git Commit 97a0cd5, or Kernel Git Commit ce2e164. Distribution maintainers ship the fix through their standard kernel security updates; coordinate with your vendor's advisory channel for the exact package version.

Workarounds

Disable durable handle support by avoiding configurations that advertise persistent or durable handles in smb.conf-equivalent ksmbd settings until patches are deployed.
Substitute Samba (smbd) for ksmbd on exposed file servers until the kernel is updated, as the user-space implementation is not affected by this code path.
Enforce SMB signing and require authenticated sessions to limit which clients can issue CREATE requests with durable contexts.

bash

# Temporarily disable and unload the ksmbd kernel module
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd

# Verify the module is no longer loaded
lsmod | grep ksmbd

# Block inbound SMB while planning the kernel update
sudo iptables -A INPUT -p tcp --dport 445 -j DROP