CVE-2026-53198 Overview
CVE-2026-53198 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the deferred byte-range locking path, where a second SMB2_CANCEL request targeting the same AsyncId re-runs smb2_remove_blocked_lock() against an already-freed struct file_lock. An authenticated SMB client can trigger the condition, which KASAN reports as a slab-use-after-free in the file_lock_cache (size 192). Exploitation requires a valid SMB session, but the resulting memory corruption occurs in kernel context.
Critical Impact
An authenticated remote SMB client can trigger a kernel slab use-after-free, leading to denial of service or potential kernel memory corruption.
Affected Products
- Linux kernel ksmbd SMB3 server module
- Stable kernel branches prior to the fixes in commits 0da2e07, 14d2eee, 2b2eda2, 89ae9df, b7063c7, and f580d27
- Distributions shipping vulnerable ksmbd builds with SMB server functionality enabled
Discovery Timeline
- 2026-06-25 - CVE-2026-53198 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53198
Vulnerability Analysis
A deferred byte-range lock, an SMB2_LOCK that blocks, registers async work on conn->async_requests via setup_async_work(). The work stores cancel_fn = smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock. When the request is cancelled, the worker frees the lock with locks_free_lock() and takes the cancelled early-exit path. That path uses goto out and never reaches release_async_work(), which is the only site that unlinks the work from conn->async_requests and clears cancel_fn/cancel_argv. The work remains matchable on async_requests with a live cancel_fn pointing at the freed file_lock until connection teardown. The flaw maps to [CWE-416] Use After Free.
Root Cause
smb2_cancel() fires cancel_fn unconditionally with no state guard. There is no check confirming whether the work has already been cancelled and its arguments invalidated. The patch skips any work whose state is already KSMBD_WORK_CANCELLED, preventing the cancel callback from firing a second time on freed memory.
Attack Vector
An authenticated SMB client sends an SMB2_LOCK that blocks, then issues a first SMB2_CANCEL to cancel the deferred lock. The cancel worker frees the file_lock but leaves the async work entry intact on conn->async_requests. The client then sends a second SMB2_CANCEL targeting the same AsyncId within the race window. smb2_cancel() re-runs smb2_remove_blocked_lock() on the freed file_lock, producing a slab use-after-free in file_lock_cache. The condition was reproduced on mainline with KASAN by an authenticated SMB client.
No public proof-of-concept code is available. Technical details are documented in the upstream Linux kernel commits: Commit 0da2e07, Commit 14d2eee, Commit 2b2eda2, Commit 89ae9df, Commit b7063c7, and Commit f580d27.
Detection Methods for CVE-2026-53198
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in __locks_delete_block with call stacks through ksmbd_vfs_posix_lock_unblock, smb2_remove_blocked_lock, and smb2_cancel.
- Kernel oops or panic traces originating in ksmbd after SMB clients issue repeated SMB2_CANCEL commands.
- Unexpected crashes of the ksmbd server module on hosts with active authenticated SMB sessions.
Detection Strategies
- Monitor kernel logs (dmesg, journalctl -k) for KASAN, BUG, or general protection faults referencing ksmbd or file_lock_cache.
- Inspect SMB traffic for clients issuing duplicate SMB2_CANCEL requests against the same AsyncId within short windows, particularly following blocking SMB2_LOCK operations.
- Track abnormal terminations or restarts of the ksmbd kernel thread on file servers exposing SMB shares.
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized log pipeline and alert on ksmbd-tagged crash signatures.
- Audit which hosts have ksmbd loaded with lsmod | grep ksmbd and confirm whether SMB exposure is intentional.
- Restrict SMB access to authenticated, trusted network segments and log all session establishment events.
How to Mitigate CVE-2026-53198
Immediate Actions Required
- Update the Linux kernel to a stable release containing the ksmbd fix referenced in the upstream commits.
- If patching is not immediately possible, unload the ksmbd module on hosts where it is not required: modprobe -r ksmbd.
- Restrict SMB access to trusted clients using host firewalls or network ACLs to reduce attacker access to the vulnerable code path.
Patch Information
The fix introduces a state guard in smb2_cancel() that skips any work already marked KSMBD_WORK_CANCELLED, preventing the cancel callback from firing twice. The fix is distributed across the stable tree in commits 0da2e073, 14d2eee0, 2b2eda28, 89ae9df0, b7063c74, and f580d27e. Apply distribution kernel updates that include these commits.
Workarounds
- Disable the ksmbd service and use a userspace SMB implementation such as Samba where feasible.
- Block inbound SMB (TCP/445) at perimeter and host firewalls from untrusted networks.
- Require strong authentication and limit the set of SMB users permitted to establish sessions against affected file servers.
# Verify kernel version and unload ksmbd if not required
uname -r
sudo systemctl stop ksmbd.service 2>/dev/null
sudo modprobe -r ksmbd
# Restrict SMB exposure at the host firewall
sudo iptables -A INPUT -p tcp --dport 445 -s <trusted_subnet> -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
