CVE-2026-43376: ksmbd: fix use-after-free by using call_rcu() for oplock_info
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free by using callrcu() for oplockinfo
ksmbd currently frees oplockinfo immediately using kfree(), even though it is accessed under RCU read-side critical sections in places like opinfoget() and procshowfiles().
Since there is no RCU grace period delay between nullifying the pointer and freeing the memory, a reader can still access oplockinfo structure after it has been freed. This can leads to a use-after-free especially in opinfoget() where atomicincnotzero() is called on already freed memory.
Fix this by switching to deferred freeing using callrcu().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43376?
The severity of CVE-2026-43376 is rated as critical with a score of 9.8.
How do I fix CVE-2026-43376?
To fix CVE-2026-43376, you should apply the available patch provided by the Linux Foundation.
What type of vulnerability is CVE-2026-43376?
CVE-2026-43376 is classified as a 'Use After Free' vulnerability.
Which software is affected by CVE-2026-43376?
CVE-2026-43376 affects the Linux kernel and specifically the ksmbd component.
When was CVE-2026-43376 published?
CVE-2026-43376 was published on May 8, 2026.