CVE-2026-53046: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53046 Overview

CVE-2026-53046 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB server. The flaw resides in ksmbd_crypt_message(), which sets a NULL completion callback on AEAD (Authenticated Encryption with Associated Data) requests and fails to handle the -EINPROGRESS return code emitted by asynchronous hardware crypto engines such as the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and frees the request while the hardware DMA operation is still in flight. The subsequent DMA completion callback then dereferences freed memory, producing a NULL pointer crash inside qce_skcipher_done().

Critical Impact
A remote SMB client interacting with a ksmbd server on hardware that uses an async crypto engine can trigger memory corruption and a kernel crash, leading to denial of service.

Affected Products

Linux kernel ksmbd SMB server module
Systems using asynchronous hardware crypto engines, specifically the Qualcomm Crypto Engine (QCE)
Stable kernel branches referenced by commits 3e29889, 57b4723, 7164b39, 8ef1832, 8fcefe8, b46aa12, and cc2da38

Discovery Timeline

2026-06-24 - CVE-2026-53046 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53046

Vulnerability Analysis

The vulnerability is a classic asynchronous-API misuse leading to use-after-free in kernel space. The ksmbd_crypt_message() function submits AEAD encryption and decryption requests through the kernel crypto API. The function passes a NULL completion callback and treats any non-zero return code as a hard failure, immediately freeing the request structures and associated buffers.

Synchronous crypto backends return 0 on completion, so this pattern functioned correctly on software ciphers. Hardware-accelerated backends like QCE return -EINPROGRESS to signal that the DMA operation has been queued and will complete asynchronously. Because ksmbd interprets -EINPROGRESS as a failure, it releases the request before the hardware finishes. When the DMA engine later fires qce_skcipher_done() through vchan_complete(), the callback reads from freed memory, leading to the observed crash on el1h_64_irq paths into ksmbd_free_work_struct() and ksmbd_exit_file_cache().

Root Cause

The root cause is improper handling of the kernel crypto API's asynchronous contract. ksmbd_crypt_message() did not register crypto_req_done() as the completion callback and did not wait on a completion object via crypto_wait_req(). Without these, the calling thread cannot determine when it is safe to free the request, creating a race between the kernel cleanup path and the hardware DMA callback.

Attack Vector

Exploitation requires an SMB session against a ksmbd server configured with SMB3 encryption on a host whose crypto framework dispatches AEAD operations to an async hardware engine such as QCE. An attacker connecting as an authenticated SMB client and triggering encrypted message exchanges can cause the freed request to be referenced by the DMA completion callback. The resulting NULL pointer dereference crashes the kernel and renders the file server unavailable.

The fix replaces the NULL callback with crypto_req_done() and wraps submission with crypto_wait_req(), mirroring the pattern used by the SMB client in fs/smb/client/smb2ops.c. This handles both synchronous engines (immediate return) and async engines (-EINPROGRESS followed by callback notification). See the kernel commit history referenced in Linux Kernel Commit 3e29889 and Linux Kernel Commit 8fcefe8 for the patch series.

Detection Methods for CVE-2026-53046

Indicators of Compromise

Kernel oops or NULL pointer dereference referencing qce_skcipher_done+0x24/0x174 in the call stack
Crash traces containing vchan_complete, ksmbd_free_work_struct, or ksmbd_exit_file_cache from an IRQ context (el1h_64_irq)
Unexpected ksmbd.mountd or kernel worker terminations on ARM64 platforms with QCE enabled
Repeated SMB session resets following encrypted SMB3 traffic from a single client

Detection Strategies

Parse /var/log/kern.log, dmesg, and journalctl -k for the specific qce_skcipher_done panic signature
Monitor ksmbd module load events on ARM64 hosts where QCE drivers (qcom-qce, crypto_qce) are also active
Inspect kernel version banners against patched stable releases incorporating commits 3e298897f41c, 57b47231055b, and b46aa129fa28

Monitoring Recommendations

Alert on kernel panics or BUG: entries originating from crypto/ or drivers/crypto/qce/ subsystems
Track SMB3 session establishment rates against ksmbd and correlate with kernel crash counters
Baseline expected ksmbd uptime and flag servers that reboot following SMB encryption traffic spikes

How to Mitigate CVE-2026-53046

Immediate Actions Required

Update the Linux kernel to a stable release containing the ksmbd async crypto fix referenced in the commit list
Inventory ARM64 and Qualcomm-based systems running ksmbd and prioritize them for patching
If patching is delayed, disable SMB3 encryption on ksmbd shares or stop the ksmbd service on affected hosts

Patch Information

The fix is distributed across multiple stable branches. Apply the kernel update that includes Linux Kernel Commit 3e29889, Linux Kernel Commit 57b4723, Linux Kernel Commit 7164b39, Linux Kernel Commit 8ef1832, Linux Kernel Commit 8fcefe8, Linux Kernel Commit b46aa12, or Linux Kernel Commit cc2da38 appropriate for your kernel branch.

Workarounds

Unload the ksmbd module on affected ARM64 hosts and use a userspace SMB server such as Samba until patched
Disable the Qualcomm Crypto Engine driver so AEAD operations fall back to a synchronous software backend
Restrict SMB access to trusted networks via firewall rules on TCP/445 to reduce exposure window

bash

# Temporary mitigation: stop ksmbd and block SMB exposure
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd
sudo iptables -A INPUT -p tcp --dport 445 -j DROP