SB20260912141 - Use-after-free in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-89635)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in ksmbd durable-handle oplock reconnection handling when reconnecting a durable file handle. A remote user can reconnect one durable handle after two sessions holding durable handles for the same file have disconnected, then trigger processing of the other handle's application instance ID to cause a denial of service.

Exploitation requires durable-v2 handles with RH leases under distinct AppInstanceIds on the same file.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3f220a0a62e6b9b391c9d1f0e6580b05173cc7f7
• https://git.kernel.org/stable/c/74e3ef4630f004c0de40c0540648a5a4033c6c9d