CVE-2026-89788: Linux Kernel Tree Connection Use-After-Free

CVE-2026-89788 is a use-after-free flaw in the Linux kernel ksmbd module affecting tree connection handling during SMB2 operations. This vulnerability allows race conditions during session logoff that could lead to memory corruption. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-89788 Overview

CVE-2026-89788 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in smb2_tree_connect() and stems from a race between tree connection creation and concurrent session logoff. After ksmbd_tree_conn_connect() publishes a new tree connection into sess->tree_conns, a parallel logoff can erase the entry and drop its reference before the handler finishes initialization, freeing the object while it is still in use. Remote, unauthenticated network attackers reachable by the SMB service can trigger the race to corrupt kernel memory.

Critical Impact
A remote attacker can trigger a slab use-after-free in the kernel SMB server, enabling denial of service and potential remote code execution at kernel privilege.

Affected Products

Linux kernel ksmbd in-kernel SMB server
Distributions shipping vulnerable stable kernel branches prior to the fix commits
Systems exposing SMB via ksmbd on network-reachable interfaces

Discovery Timeline

2026-09-16 - CVE-2026-89788 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89788

Vulnerability Analysis

The defect is a classic use-after-free triggered by a race condition between two SMB2 operations serviced by ksmbd worker threads. ksmbd_tree_conn_connect() inserts a new tree_conn object into the session's xarray (sess->tree_conns) holding a single reference, then returns the pointer to smb2_tree_connect() in fs/smb/server/smb2pdu.c. The handler continues to initialize the connection state and build the SMB2 TREE_CONNECT response after publication.

A concurrent SMB2 LOGOFF request iterates the same xarray, removes the just-published entry, and drops its reference. Because the creating handler holds no additional reference, the object is freed while smb2_tree_connect() is still dereferencing it. KASAN reports the condition as slab-use-after-free in smb2_tree_connect+0xe3d/0xf90.

Root Cause

The root cause is unbalanced reference counting at publication time. Publishing a shared object into a lookup structure without acquiring a second reference for the in-flight creator violates the ownership model. Any concurrent teardown path that removes the entry can free the object out from under the creator, producing a use-after-free [CWE-416].

Attack Vector

Exploitation requires network reachability to a host running ksmbd. An unauthenticated remote attacker opens an SMB session and races an SMB2 TREE_CONNECT against an SMB2 LOGOFF on the same session. Winning the race frees the tree_conn slab object while smb2_tree_connect() continues to write into it, corrupting kernel memory. Successful exploitation can crash the kernel or, with a controlled heap layout, escalate to arbitrary code execution in kernel context.

No verified public proof-of-concept code is available. Refer to the upstream fix commits for the exact synchronization changes: kernel.org commit 4e30fbd2 and kernel.org commit b5ec6c46.

Detection Methods for CVE-2026-89788

Indicators of Compromise

Kernel panics or oops messages referencing smb2_tree_connect in the call stack
KASAN reports of slab-use-after-free in fs/smb/server/smb2pdu.c on hosts with ksmbd enabled
Unexpected ksmbd worker thread crashes correlated with rapid SMB2 TREE_CONNECT and LOGOFF sequences from a single client

Detection Strategies

Inspect kernel ring buffer (dmesg) and /var/log/kern.log for ksmbd fault traces involving smb2_tree_connect or ksmbd_tree_conn_disconnect
Correlate SMB session establishment and logoff events at abnormal rates from the same source against network telemetry
Enable KASAN on test builds to surface latent races during fuzzing of the SMB2 protocol surface

Monitoring Recommendations

Alert on repeated ksmbd worker crashes or automatic service restarts on SMB-facing Linux hosts
Monitor SMB traffic on TCP/445 for high-frequency TREE_CONNECT and LOGOFF interleaving from a single peer
Track kernel version inventory to identify hosts running ksmbd builds prior to the fix

How to Mitigate CVE-2026-89788

Immediate Actions Required

Apply the upstream fix by updating to a kernel release containing commits 4e30fbd2 and b5ec6c46
If patching is not immediately possible, disable the ksmbd module on hosts that do not require in-kernel SMB serving
Restrict SMB (TCP/445) exposure to trusted networks using host and perimeter firewalls

Patch Information

The fix takes a second reference after xa_store() succeeds and before releasing tree_conns_lock. The xarray entry owns one reference and the creating smb2_tree_connect() handler owns the second. Error and cleanup paths only drop the xarray reference if they atomically claim the disconnected state and remove the exact entry, ensuring balanced references regardless of which teardown path wins. Patches are available at kernel.org commit 4e30fbd2 and kernel.org commit b5ec6c46.

Workarounds

Unload the module with modprobe -r ksmbd and blacklist it where SMB serving is unnecessary
Migrate SMB workloads to a userspace server such as Samba until the kernel is patched
Enforce firewall rules that deny inbound TCP/445 from untrusted sources

bash

# Disable and blacklist the ksmbd module until patched
sudo systemctl stop ksmbd 2>/dev/null || true
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB exposure at the host firewall
sudo iptables -A INPUT -p tcp --dport 445 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP