External risk intelligence

Linux Kernel ksmbd Use-After-Free in Durable Handle Owner Check.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72381

The vulnerability exists in ksmbd, a kernel-based SMB server. SMB/CIFS is a protocol specifically designed to provide remote file access and is commonly exposed as a network service. In deployments where ksmbd is utilized, the service is intended to be reachable over the network to facilitate file sharing, making it a public-facing or internal-facing service by design.

Use After Free

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability within the Linux kernel's SMB server component, specifically affecting how it handles file connections. The flaw could allow an attacker to compromise system integrity and data confidentiality through a network-based exploit, underscoring the need to confirm its relevance to your environment.

A Linux kernel flaw could allow system compromise.
It impacts network-accessible file sharing services.
Verify relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a race condition in the Linux kernel's SMB server (ksmbd). This occurs when two concurrent SMB2 durable reconnect attempts happen on the same persistent ID. The vulnerability allows an attacker to read or write to memory that has already been freed, potentially leading to system instability or compromise.

Entry condition: Network access to the SMB server.
Trigger point: Concurrent SMB2 durable reconnects.
Resulting risk: Memory corruption, potential system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's SMB server could allow an attacker to crash the service or potentially gain unauthorized access by exploiting a race condition during durable reconnects. The issue arises when handling persistent connections, where a comparison of file owner information can occur after that information has been freed, leading to memory corruption. This could impact the availability and integrity of file-sharing services when specific concurrent operations are performed.

File sharing service integrity and availability.
Concurrent durable reconnects may trigger the race.
Service instability or potential unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's ksmbd component likely impacts infrastructure or platform teams managing file-sharing services, as well as security teams responsible for network exposure. The initial step is to identify all instances of ksmbd, determine their network reachability and business criticality, and then confirm the accountable owner for remediation.

Infrastructure or Platform teams own resolution.
Verify ksmbd network exposure and criticality.
Plan remediation based on confirmed ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ksmbd component in the Linux kernel?

ksmbd is an in-kernel server that implements the SMB protocol, which Linux systems use to share files and printers over a network. It allows Windows, macOS, and Linux clients to connect to a Linux host to access stored data, making it a central component for network-based file storage and interoperability.

What does this use-after-free vulnerability mean?

This is a memory management error where the software attempts to access data after the memory it occupied has been released. In this specific case, the flaw involves a race condition where the server tries to read a file owner's name at the same time another process deletes it, potentially leading to system instability or unauthorized memory access.

How can an attacker trigger this bug?

An attacker needs network access to the SMB service to send a specific sequence of commands. The bug is triggered by forcing two concurrent 'durable reconnect' requests for the same file ID. Simple file access or standard connection requests that do not involve these specific overlapping reconnect attempts do not trigger this vulnerability.

Do I need to worry about this if my server is internal?

Yes. Halo Surface Signal notes that ksmbd is designed to be reachable over the network to provide file sharing, meaning it is often active on both public-facing and internal-facing segments. If your infrastructure uses ksmbd to facilitate file access, the service is inherently positioned to handle network requests, making it relevant regardless of whether it resides on the perimeter or inside your network.

What are the first steps to take if I run ksmbd?

Start by identifying all Linux systems in your environment that have the ksmbd service enabled. Assess which systems are critical for file sharing and evaluate their network reachability to understand your potential risk. Once identified, coordinate with the infrastructure or platform teams responsible for those servers to plan for a software update to the kernel.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.