CVE-2026-80926: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80926 Overview

CVE-2026-80926 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the smb2_oplock_break_noti() function, which reads opinfo->conn without holding a lock and dereferences it after two sleeping allocations. Any authenticated client holding a durable batch oplock can trigger the race, potentially leading to remote code execution in kernel context.

Critical Impact
An authenticated remote attacker can exploit a race condition in ksmbd oplock break handling to dereference freed kernel memory, enabling potential kernel-mode code execution or denial of service.

Affected Products

Linux kernel with ksmbd (in-kernel SMB server) enabled
Distributions shipping vulnerable stable kernel branches referenced by the upstream fixes
Systems exposing SMB shares via ksmbd to authenticated clients

Discovery Timeline

2026-09-11 - CVE-2026-80926 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80926

Vulnerability Analysis

The vulnerability lives in the ksmbd oplock break notification path. When a durable handle owning an oplock disconnects, session_fd_check() clears opinfo->conn and drops its conn reference under ci->m_lock. The final ksmbd_conn_put() then frees the connection object.

A break triggered by a second connection can race with this teardown. Because smb2_oplock_break_noti() reads opinfo->conn without locking, and because ksmbd_conn_get() is only an atomic_inc with no validity check, the racing thread can resurrect a freed connection. Queued break work later dereferences the stale pointer through ksmbd_conn_write(), producing a use-after-free reachable by any authenticated client holding a durable batch oplock [CWE-416].

Root Cause

The root cause is missing synchronization between the oplock break notification path and connection teardown. Reading opinfo->conn outside ci->m_lock — the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update the field — permits the read to observe a pointer that is concurrently being freed. Sleeping allocations between the read and the dereference widen the race window significantly.

Attack Vector

Exploitation requires network access to the SMB service and valid credentials to open a durable batch oplock. An attacker opens a durable handle, forces a second connection to trigger an oplock break, and races the break work against the durable handle's disconnect. Successful exploitation corrupts kernel memory and can escalate to arbitrary code execution in ring 0. No user interaction is required beyond initial authentication.

No public proof-of-concept code is available. The upstream fix threads the caller's inode into the notification path and selects the connection under ci->m_lock, ensuring a concurrent detach either loses the race or keeps the connection alive until the notification work releases it. See the upstream commits: Kernel Git Commit 0e75389, Kernel Git Commit 8cc98db, and Kernel Git Commit c8279ae.

Detection Methods for CVE-2026-80926

Indicators of Compromise

Kernel oops or panic messages referencing smb2_oplock_break_noti, ksmbd_conn_write, or ksmbd_conn_put in dmesg or /var/log/kern.log
KASAN use-after-free reports naming ksmbd_conn objects on kernels built with sanitizers enabled
Unexpected ksmbd.mountd or worker thread crashes correlated with SMB client reconnects

Detection Strategies

Monitor authenticated SMB sessions for rapid open/close cycles on durable handles with batch oplocks, which can indicate race attempts.
Enable KASAN and lockdep on test kernels to surface the use-after-free during fuzzing or QA of SMB workloads.
Correlate SMB2 OPLOCK_BREAK notification traffic patterns with kernel error telemetry from endpoint sensors.

Monitoring Recommendations

Ingest kernel logs into a centralized SIEM and alert on ksmbd-related stack traces or BUG: entries.
Track running kernel versions across the fleet and flag hosts running vulnerable versions that expose port 445.
Baseline SMB share access patterns and alert on anomalous durable handle activity from newly authenticated principals.

How to Mitigate CVE-2026-80926

Immediate Actions Required

Apply the upstream kernel patches referenced in the commit list or upgrade to a distribution kernel that includes the fix.
Restrict access to ksmbd shares by firewalling TCP port 445 to trusted networks only.
Audit SMB accounts and disable any that are unused, since exploitation requires authenticated access.

Patch Information

The fix has been merged upstream across three commits: Kernel Git Commit 0e75389, Kernel Git Commit 8cc98db, and Kernel Git Commit c8279ae. The patch threads the caller's inode through the notification path and pins the connection under ci->m_lock, eliminating the window in which opinfo->conn can be freed between read and dereference. Ownership of the connection reference is transferred to the work item, which releases it on allocation failure.

Workarounds

Unload the ksmbd module (modprobe -r ksmbd) and use an alternative SMB server such as Samba until patches are applied.
Block inbound SMB traffic at network and host firewalls where ksmbd cannot be disabled.
Disable durable handle and oplock support on exposed shares if operationally feasible to remove the exploitation primitive.

bash

# Configuration example: disable ksmbd until patched
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd

# Restrict SMB access at the host firewall (nftables example)
sudo nft add rule inet filter input tcp dport 445 drop