CVE-2026-72381: ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
Two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistentid race the fp->owner.name compare-read in ksmbdvfscomparedurableowner() against the kfree() in ksmbdreopendurablefd()'s reopen-success path. fp->owner.name is a standalone kstrdup() buffer whose lifetime is independent of the fp refcount, and the two sites share no lock: the compare reads the buffer while the reopen frees it, so the strcmp() can dereference freed memory.
Commit 7ce4fc40018d ("ksmbd: fix durable reconnect double-bind race in ksmbdreopendurablefd") made the fp->conn claim atomic under globalft.lock (closing the owner.name double-free and the ksmbdfile write-UAF), but the compare-read versus reopen-free pair was left unserialized.
BUG: KASAN: slab-use-after-free in strcmp+0x2c/0x80 Read of size 1 by task kworker strcmp ksmbdvfscomparedurableowner smb2checkdurableoplock smb2open Freed by task kworker: kfree ksmbdreopendurablefd smb2open Allocated by task kworker: kstrdup sessionfdcheck smb2sessionlogoff The buggy address belongs to the cache kmalloc-8
Serialize both sides of the race with fp->flock. The global durable file-table lock still protects the durable reconnect claim, but fp->owner.name is per-open state and does not need to block unrelated durable table lookups or reconnects. The teardown is left at its existing location after the reopen-success point so that an openid() rollback still retains owner.name for a later legitimate reconnect to verify.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-34.34~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1012.12~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-34.34 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1007.8 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1020.20 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1 - Compensating control
Serialize the fp->owner.name compare-read in ksmbd_vfs_compare_durable_owner() and the kfree() in ksmbd_reopen_durable_fd() with fp->f_lock.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72381?
CVE-2026-72381 has a risk severity rating of 48.
How do I fix CVE-2026-72381?
To fix CVE-2026-72381, ensure that your Linux kernel is updated to the latest patched version that addresses this use-after-free vulnerability.
What kind of vulnerability is CVE-2026-72381?
CVE-2026-72381 is categorized as a use-after-free vulnerability in the Linux kernel.
What component is affected by CVE-2026-72381?
CVE-2026-72381 affects the ksmbd component of the Linux kernel.
What implications does CVE-2026-72381 have for users?
CVE-2026-72381 can potentially lead to data corruption or denial of service due to the race condition in SMB2 durable reconnection handling.