CVE-2026-68381: Linux Kernel Race Condition Vulnerability

CVE-2026-68381 Overview

CVE-2026-68381 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the asynchronous oplock and lease break notification paths, where smb2_oplock_break_noti() and smb2_lease_break_noti() publish a ksmbd_conn pointer to a queued work item without taking a real reference on the connection object. A race between connection teardown and the queued notification worker can free the ksmbd_conn before ksmbd_conn_write() and ksmbd_conn_r_count_dec() access it.

Critical Impact
Remote, unauthenticated attackers on the network can potentially trigger a use-after-free in kernel memory, leading to kernel memory corruption, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux kernel builds with CONFIG_SMB_SERVER (ksmbd) enabled
Linux distributions shipping vulnerable ksmbd revisions prior to the referenced stable commits
Network-attached storage and file servers exposing SMB via ksmbd

Discovery Timeline

2026-08-10 - CVE-2026-68381 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68381

Vulnerability Analysis

The ksmbd subsystem implements SMB2/SMB3 server functionality inside the Linux kernel. When a client holds an oplock or lease, the server sends asynchronous break notifications through smb2_oplock_break_noti() and smb2_lease_break_noti(). Both functions place a ksmbd_conn pointer into an async ksmbd_work structure and queue that work on the ksmbd-io workqueue.

The queued work only increments conn->r_count. That counter prevents teardown from advancing past the pending-request wait once the increment lands, but it does not pin the struct ksmbd_conn allocation itself. If connection teardown races the notification path, the final connection reference can drop before the worker executes. The worker then dereferences a freed object in ksmbd_conn_write() and ksmbd_conn_r_count_dec(), producing a classic use-after-free [CWE-416].

Root Cause

The root cause is an incorrect object lifetime contract. The producer publishes a raw ksmbd_conn pointer to a deferred consumer without acquiring a reference that guarantees the object outlives the work item. The r_count counter is a request-tracking gate, not a lifetime primitive, so it cannot prevent the underlying ksmbd_conn from being freed during teardown.

Attack Vector

An attacker with network access to a ksmbd share can trigger the race by initiating SMB sessions that acquire oplocks or leases, then abruptly tearing down the TCP connection while a break notification is in flight. Repeated iterations increase the probability of hitting the window between the async work being queued and the worker executing. Successful exploitation corrupts kernel memory and can escalate to remote kernel code execution.

The upstream fix takes a real reference on ksmbd_conn when publishing it to the async work item and drops that reference after the notification work decrements r_count. See the Linux kernel stable commits 0f72fc9659d7, 14062c74e5b2, 6ecb252efa0b, 793e1c7041b9, and aa5d8f3f96aa for the patched code paths.

Detection Methods for CVE-2026-68381

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ksmbd_conn_write, ksmbd_conn_r_count_dec, or the ksmbd-io workqueue
KASAN use-after-free reports naming ksmbd_conn allocations on hosts running ksmbd
Bursts of short-lived SMB sessions from a single source followed by abrupt TCP resets during oplock or lease activity
ksmbd worker threads terminating or the SMB service crashing under sustained client churn

Detection Strategies

Enable KASAN on test kernels to surface ksmbd_conn use-after-free conditions before production impact
Monitor dmesg and journald for kernel warnings originating in fs/smb/server/ call sites
Correlate SMB session teardown events with kernel crash telemetry to identify race-condition exploitation attempts
Baseline SMB client behavior and alert on anomalous connect-disconnect patterns targeting ksmbd hosts

Monitoring Recommendations

Ingest kernel logs and crash dumps into a centralized analytics platform for pattern detection across the fleet
Track ksmbd process restarts and workqueue anomalies as leading indicators of exploitation
Alert on SMB traffic from untrusted networks reaching hosts that run the in-kernel SMB server
Review authentication logs on SMB endpoints for anonymous or guest-level session negotiation attempts

How to Mitigate CVE-2026-68381

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits to all hosts running ksmbd
Restrict SMB access on ksmbd hosts to trusted network segments using firewall rules on TCP port 445
Disable ksmbd on systems that do not require in-kernel SMB serving until patched kernels are deployed
Prioritize patching of internet-exposed or DMZ-hosted ksmbd instances

Patch Information

The fix acquires a real ksmbd_conn reference when publishing the pointer to the async work item and releases it after the notification work decrements r_count. The same lifetime rule is applied to the lease break notification path. Merge the fixes from the Linux stable tree commits 0f72fc9659d7, 14062c74e5b2, 6ecb252efa0b, 793e1c7041b9, and aa5d8f3f96aa, or upgrade to a distribution kernel that incorporates them.

Workarounds

Unload the ksmbd module (modprobe -r ksmbd) on systems where SMB serving is not required
Replace ksmbd with user-space Samba on affected hosts until a patched kernel is available
Block inbound SMB (TCP 445) from untrusted networks at the perimeter and host firewall
Enforce SMB signing and authentication to reduce the pool of clients able to reach the vulnerable code paths

bash

# Disable and unload ksmbd until a patched kernel is deployed
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB to trusted management network only
sudo iptables -A INPUT -p tcp --dport 445 ! -s 10.0.0.0/8 -j DROP