External risk intelligence

Linux Kernel ksmbd Use-After-Free in SMB2 Negotiate.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72422

The vulnerability exists in ksmbd, a kernel-based SMB server. SMB (Server Message Block) is a network file sharing protocol commonly deployed as an edge service or network gateway for file access. While it should ideally be restricted to internal networks, it is frequently exposed or reachable in deployments serving file shares to remote clients or through misconfigured network perimeters.

Use After Free

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been resolved in the Linux kernel's ksmbd component, which handles Server Message Block (SMB) network file sharing. This issue could allow an attacker to cause a use-after-free condition by sending concurrent requests, potentially leading to system instability or unauthorized access. The main concern is confirming if this specific kernel component is in use and exposed externally.

Linux kernel SMB sharing has a critical flaw.
It impacts system stability and data integrity.
Verify ksmbd usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending two SMB2 NEGOTIATE requests concurrently over the same network connection to a Linux kernel's SMB server. This timing issue, a use-after-free in the connection handling, could allow an attacker to read or write to freed memory, potentially leading to a system crash or code execution.

Network access to the SMB server is required.
Concurrent SMB2 NEGOTIATE requests trigger the flaw.
Risk includes potential denial-of-service or code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact systems running the Linux kernel that use the ksmbd component for SMB file sharing. When multiple concurrent SMB2 NEGOTIATE requests are processed, a race condition can occur, leading to a use-after-free vulnerability. This could potentially allow an attacker to corrupt memory, leading to system instability or the execution of arbitrary code.

Kernel memory corruption.
Concurrent SMB2 requests race condition.
System instability or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's SMB daemon (ksmbd) is affected by a use-after-free vulnerability in its concurrent SMB2 NEGOTIATE handler. This could allow an unauthenticated, remote attacker to achieve arbitrary code execution or a denial-of-service condition. Action should be initiated by infrastructure or platform teams responsible for the Linux kernel and its services, who must first identify all instances of ksmbd, confirm their network exposure, and then prioritize remediation based on the criticality and reachability of each instance.

Infrastructure/platform teams own remediation.
Verify ksmbd network exposure and criticality.
Plan targeted updates or compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ksmbd component in the Linux kernel?

ksmbd is a kernel-based server implementation of the SMB protocol. It allows Linux systems to provide network file sharing services directly from the kernel space, often used to enable high-performance file access between computers on a network.

What is a use-after-free vulnerability in CVE-2026-72422?

This is a memory management flaw where a program continues to use a pointer to a memory location after that memory has been freed. In this case, the kernel's SMB handler frees connection information while another process is still trying to read it, which can lead to unpredictable system behavior or memory corruption.

How does an attacker trigger this kernel vulnerability?

The flaw is triggered by sending two SMB2 NEGOTIATE requests simultaneously over the same network connection. This race condition forces the server's internal logic to free the connection data while a concurrent process is still accessing it. Sending single or non-concurrent requests does not trigger this race condition.

Is my system at risk according to Halo Surface Signal?

Risk depends on your network configuration. Halo Surface Signal identifies ksmbd as a network file sharing service often used at the edge or as a gateway. While SMB is typically for internal networks, systems where ksmbd is reachable from the internet or exposed through misconfigured perimeters are at a higher likelihood of being targeted.

What should I do to respond to CVE-2026-72422?

First, identify all systems in your environment that are actively using the ksmbd kernel module. Next, determine if those instances are exposed to external networks. Once mapped, prioritize these systems for kernel updates provided by your distribution or vendor to resolve the memory race condition.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.