CVE-2026-89635: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89635 Overview

CVE-2026-89635 is a use-after-free vulnerability in the Linux kernel's ksmbd SMB server implementation. The flaw resides in ksmbd_reopen_durable_fd(), which handles durable file handle reconnection over SMB3. The function walks the inode's m_op_list and rebinds every detached oplock to the reconnecting session, keyed only on op->conn == NULL. This allows one session to adopt another session's oplock during reconnect, leading to a stale session pointer that is later dereferenced after the original session is freed.

Critical Impact
An authenticated remote attacker with SMB access to a share configured with default durable-handle and oplock settings can trigger a kernel use-after-free, resulting in memory corruption, denial of service, or potential remote code execution in kernel context.

Affected Products

Linux kernel ksmbd in-kernel SMB3 server
Linux distributions shipping affected kernels with ksmbd enabled
SMB shares configured with durable-v2 handles and RH leases (default)

Discovery Timeline

2026-09-11 - CVE-2026-89635 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89635

Vulnerability Analysis

The vulnerability manifests in ksmbd_reopen_durable_fd() when handling SMB3 durable-v2 handle reconnection. The function iterates over all detached oplocks on an inode's m_op_list and rebinds them to the reconnecting session using only op->conn == NULL as the selection criterion. Every detached durable handle on the same inode matches this condition, not just the one owned by the file pointer fp being reopened.

When two SMB sessions hold durable handles on the same file and both disconnect, reconnecting one session causes it to adopt the other session's oplock. The field op->sess is overwritten with the reconnecting session without acquiring a reference, while op->conn pins the connection and keeps it live. Once the adopting session is destroyed, ksmbd_session_destroy() frees it while the foreign oplock still references it.

The reader in ksmbd_close_fd_app_instance_id() validates only opinfo->conn, which remains valid, then dereferences the stale opinfo->sess->file_table pointer. KASAN reports a slab-use-after-free write in _raw_write_lock reached through smb2_open and handle_ksmbd_work.

Root Cause

The root cause is an overly broad matching condition in the oplock rebind loop. The code assumes any detached oplock on the inode belongs to the reconnecting file, but multiple sessions can legitimately hold detached durable handles on the same inode. The sibling teardown path session_fd_check() correctly keys on connection identity (op->conn == conn), demonstrating the intended pattern.

Attack Vector

Exploitation requires an authenticated SMB session against a share with default durable-handle and oplock configuration. Two sessions open the same file with durable-v2 handles and RH leases under distinct AppInstanceIds. Both sessions log off, one reconnects with a DH2C create, and a later durable-v2 create carrying the other AppInstanceId walks into the freed session, triggering the use-after-free in kernel memory.

See the upstream fix in Kernel Git Commit 3f220a0 and the backport at Kernel Git Commit 74e3ef4 for the constrained loop implementation.

Detection Methods for CVE-2026-89635

Indicators of Compromise

Kernel oops or KASAN slab-use-after-free reports referencing ksmbd_close_fd_app_instance_id, _raw_write_lock, or smb2_open in the call trace
Unexpected ksmbd worker thread crashes in handle_ksmbd_work on hosts running the in-kernel SMB server
Repeated SMB2 CREATE requests carrying durable-v2 contexts and distinct AppInstanceId values targeting the same file from different sessions

Detection Strategies

Monitor dmesg and kernel ring buffers for KASAN, BUG, or general protection fault entries originating from fs/smb/server/
Enable SMB audit logging on ksmbd hosts and alert on rapid session logoff and reconnect sequences using DH2C against shared files
Correlate SMB session teardown events with subsequent AppInstanceId-based CREATE operations from different client identities

Monitoring Recommendations

Inventory Linux hosts with the ksmbd module loaded using lsmod | grep ksmbd and track kernel versions against patched builds
Deploy endpoint telemetry to capture kernel crash dumps and forward them to a central log platform for retrospective analysis
Alert on anomalous SMB client behavior involving repeated durable handle reconnects from multiple client instance identifiers

How to Mitigate CVE-2026-89635

Immediate Actions Required

Apply the upstream kernel patch that constrains the rebind loop to the oplock owned by the file being reopened
If patching is not immediately possible, disable the ksmbd module on hosts where it is not required using modprobe -r ksmbd
Restrict SMB share access to trusted, authenticated users only and audit existing share permissions

Patch Information

The fix constrains the oplock rebind loop in ksmbd_reopen_durable_fd() to only the oplock owned by the file pointer being reopened, preventing cross-session oplock adoption. Patched commits are available at Kernel Git Commit 3f220a0 and Kernel Git Commit 74e3ef4. Update to a kernel release that incorporates these commits and reboot affected systems.

Workarounds

Migrate SMB file services to a userspace implementation such as Samba until the kernel patch is deployed
Disable durable handle support on ksmbd shares where operationally acceptable to prevent the reconnect code path from being reached
Block inbound TCP port 445 at the network perimeter and segment ksmbd hosts to trusted management networks only

bash

# Configuration example: unload ksmbd and block SMB at the host firewall
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
sudo iptables -A INPUT -p tcp --dport 445 -j DROP