CVE-2026-89788 Overview
CVE-2026-89788 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in smb2_tree_connect() and stems from a race between tree connection creation and concurrent session logoff. After ksmbd_tree_conn_connect() publishes a new tree connection into sess->tree_conns, a parallel logoff can erase the entry and drop its reference before the handler finishes initialization, freeing the object while it is still in use. Remote, unauthenticated network attackers reachable by the SMB service can trigger the race to corrupt kernel memory.
Critical Impact
A remote attacker can trigger a slab use-after-free in the kernel SMB server, enabling denial of service and potential remote code execution at kernel privilege.
Affected Products
- Linux kernel ksmbd in-kernel SMB server
- Distributions shipping vulnerable stable kernel branches prior to the fix commits
- Systems exposing SMB via ksmbd on network-reachable interfaces
Discovery Timeline
- 2026-09-16 - CVE-2026-89788 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89788
Vulnerability Analysis
The defect is a classic use-after-free triggered by a race condition between two SMB2 operations serviced by ksmbd worker threads. ksmbd_tree_conn_connect() inserts a new tree_conn object into the session's xarray (sess->tree_conns) holding a single reference, then returns the pointer to smb2_tree_connect() in fs/smb/server/smb2pdu.c. The handler continues to initialize the connection state and build the SMB2 TREE_CONNECT response after publication.
A concurrent SMB2 LOGOFF request iterates the same xarray, removes the just-published entry, and drops its reference. Because the creating handler holds no additional reference, the object is freed while smb2_tree_connect() is still dereferencing it. KASAN reports the condition as slab-use-after-free in smb2_tree_connect+0xe3d/0xf90.
Root Cause
The root cause is unbalanced reference counting at publication time. Publishing a shared object into a lookup structure without acquiring a second reference for the in-flight creator violates the ownership model. Any concurrent teardown path that removes the entry can free the object out from under the creator, producing a use-after-free [CWE-416].
Attack Vector
Exploitation requires network reachability to a host running ksmbd. An unauthenticated remote attacker opens an SMB session and races an SMB2 TREE_CONNECT against an SMB2 LOGOFF on the same session. Winning the race frees the tree_conn slab object while smb2_tree_connect() continues to write into it, corrupting kernel memory. Successful exploitation can crash the kernel or, with a controlled heap layout, escalate to arbitrary code execution in kernel context.
No verified public proof-of-concept code is available. Refer to the upstream fix commits for the exact synchronization changes: kernel.org commit 4e30fbd2 and kernel.org commit b5ec6c46.
Detection Methods for CVE-2026-89788
Indicators of Compromise
- Kernel panics or oops messages referencing smb2_tree_connect in the call stack
- KASAN reports of slab-use-after-free in fs/smb/server/smb2pdu.c on hosts with ksmbd enabled
- Unexpected ksmbd worker thread crashes correlated with rapid SMB2 TREE_CONNECT and LOGOFF sequences from a single client
Detection Strategies
- Inspect kernel ring buffer (dmesg) and /var/log/kern.log for ksmbd fault traces involving smb2_tree_connect or ksmbd_tree_conn_disconnect
- Correlate SMB session establishment and logoff events at abnormal rates from the same source against network telemetry
- Enable KASAN on test builds to surface latent races during fuzzing of the SMB2 protocol surface
Monitoring Recommendations
- Alert on repeated ksmbd worker crashes or automatic service restarts on SMB-facing Linux hosts
- Monitor SMB traffic on TCP/445 for high-frequency TREE_CONNECT and LOGOFF interleaving from a single peer
- Track kernel version inventory to identify hosts running ksmbd builds prior to the fix
How to Mitigate CVE-2026-89788
Immediate Actions Required
- Apply the upstream fix by updating to a kernel release containing commits 4e30fbd2 and b5ec6c46
- If patching is not immediately possible, disable the ksmbd module on hosts that do not require in-kernel SMB serving
- Restrict SMB (TCP/445) exposure to trusted networks using host and perimeter firewalls
Patch Information
The fix takes a second reference after xa_store() succeeds and before releasing tree_conns_lock. The xarray entry owns one reference and the creating smb2_tree_connect() handler owns the second. Error and cleanup paths only drop the xarray reference if they atomically claim the disconnected state and remove the exact entry, ensuring balanced references regardless of which teardown path wins. Patches are available at kernel.org commit 4e30fbd2 and kernel.org commit b5ec6c46.
Workarounds
- Unload the module with modprobe -r ksmbd and blacklist it where SMB serving is unnecessary
- Migrate SMB workloads to a userspace server such as Samba until the kernel is patched
- Enforce firewall rules that deny inbound TCP/445 from untrusted sources
# Disable and blacklist the ksmbd module until patched
sudo systemctl stop ksmbd 2>/dev/null || true
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
# Restrict SMB exposure at the host firewall
sudo iptables -A INPUT -p tcp --dport 445 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.