CVE-2026-43376: ksmbd: fix use-after-free by using call_rcu() for oplock_info

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-08 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free by using call_rcu() for oplock_info ksmbd currently frees oplock_info immediately using kfree(), even though it is accessed under RCU read-side critical sections in places like opinfo_get() and proc_show_files(). Since there is no RCU grace period delay between nullifying the pointer and freeing the memory, a reader can still access oplock_info structure after it has been freed. This can leads to a use-after-free especially in opinfo_get() where atomic_inc_not_zero() is called on already freed memory. Fix this by switching to deferred freeing using call_rcu().

Affected products

Linux kernel: from 6.6.88 before 6.6.130; from 6.12.25 before 6.12.78; from 6.14.4 before 6.15; from 6.15.1 before 6.18.19; from 6.19 before 6.19.9; 6.15, 6.15-rc3, 6.15-rc4, 6.15-rc5, 6.15-rc6, 6.15-rc7 (+3) — fixed in 6.12.78, 6.15, 6.18.19, 6.19.9, 6.6.130

How to fix

Upgrade to a fixed version: Linux kernel 6.12.78, 6.15, 6.18.19, 6.19.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-43376 or the next vulnerability affects your stack