Use-after-free in Linux kernel - CVE-2026-74522

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __close_file_table_ids() when tearing down a file table after logical file close and reference release across sessions. A local user can trigger cross-session file reference handling to dereference a stale pointer and cause a denial of service.

Exploitation requires another session to hold a temporary reference to the same ksmbd_file obtained through ksmbd_lookup_fd_inode().

Affected software

How to mitigate CVE-2026-74522

External References

• https://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac
• https://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd
• https://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f
• https://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459
• https://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66

Related Security Bulletins

• Use-after-free in Linux kernel smb server
• Debian update for linux