CVE-2026-53010: ksmbd: fix use-after-free in smb2_open during durable reconnect
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in smb2open during durable reconnect
In smb2open, the call to ksmbdputdurablefd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbdiovpinrsp fails) or a scavenger accesses the file, it leads to a use-after-free when accessing fp properties (eg fp->createtime).
Move the single put to the end of the function below errout2 so fp stays valid until smb2open returns.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with ksmbd in use are relevant. The flaw is in the SMB2 durable reconnect path in ksmbd.
What conditions are needed to trigger the use-after-free?
The issue occurs during a durable reconnect in smb2_open when the durable file descriptor is released early and a later error occurs, such as ksmbd_iov_pin_rsp failing, or when a scavenger accesses the file.
What should teams do to remediate it?
Apply an available patch for the Linux kernel. The fix keeps the durable file descriptor valid until smb2_open returns by moving its reference release to the end of the function.