UBUNTU-CVE-2026-74522: Use After Free
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids() A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode(). ksmbdclosefd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbdfdput(), putfdfinal() supplies the foreign session's file table to ksmbdclosefd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbdclosefd() still holds that table's lock, and clear volatileid before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ksmbd_close_fd(), remove the volatile ID from the owner's idr while holding that table's lock, and clear volatile_id before dropping the idr-owned reference.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running one of the listed Ubuntu Linux kernel packages are potentially exposed if they use the ksmbd kernel SMB server functionality. The provided data does not identify specific affected package versions or configurations.
What access does an attacker need to exploit it?
The severity vector indicates network reachability, low privileges, no user interaction, high attack complexity, and that an additional attack requirement is present. The flaw involves a temporary file reference held by another SMB session during file closure.
What is the potential impact?
Successful exploitation can cause a use-after-free when the owning session later tears down its file table and dereferences a stale file pointer. The supplied vector rates confidentiality, integrity, and availability impact as high.
How can I determine whether a system may be affected?
Check whether the host is running a listed Ubuntu kernel package and whether ksmbd is in use. The provided information does not include vulnerable or fixed version numbers, so it cannot establish exposure from package version alone.