Use-after-free in Linux kernel - CVE-2026-53198
Published: June 26, 2026
Vulnerability identifier: #VU135584
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-53198
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in smb2_cancel in ksmbd when handling a second SMB2_CANCEL for the same AsyncId after cancellation of a deferred byte-range lock. A remote user can send specially crafted SMB2_CANCEL requests to cause a denial of service.
Exploitation requires authentication to the SMB service and involves a deferred SMB2_LOCK request that blocks.
How to mitigate CVE-2026-53198
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd
- https://git.kernel.org/stable/c/14d2eee0193ac3cd1bf3d014373449f0b8d35d6d
- https://git.kernel.org/stable/c/2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694
- https://git.kernel.org/stable/c/89ae9df09d2c1fb4a4eb495c113a7ce1dca34147
- https://git.kernel.org/stable/c/b7063c7426ea5a4d15e01b60538718765392f49d
- https://git.kernel.org/stable/c/f580d27e8928828693df44ba2db0fffdbe11dfea