{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23226", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.987Z", "datePublished": "2026-02-18T14:53:29.562Z", "dateUpdated": "2026-08-05T12:20:44.508Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:44.508Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add chann_lock to protect ksmbd_chann_list xarray\n\nksmbd_chann_list xarray lacks synchronization, allowing use-after-free in\nmulti-channel sessions (between lookup_chann_list() and ksmbd_chann_del).\n\nAdds rw_semaphore chann_lock to struct ksmbd_session and protects\nall xa_load/xa_store/xa_erase accesses." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP port 445, directly reachable over the network.\nAC:L - The attacker controls both sides of the race by establishing multiple SMB connections (multi-channel session) and timing a disconnect on one while the other accesses the channel list. The attacker creates and controls the race condition.\nPR:L - The channel list is populated during ntlm_authenticate() or krb5_authenticate(), requiring valid SMB credentials to establish a session before the race can be triggered. This is post-authentication.\nUI:N - No user interaction is needed; the attacker initiates and controls all SMB connections and their timing.\nS:U - The vulnerability and its impact remain within the kernel security authority; no security boundary (e.g., VM, sandbox) is crossed.\nC:H - Use-after-free on struct channel allows reading freed memory that may be reallocated with attacker-controlled content, enabling arbitrary kernel memory disclosure including signing keys.\nI:H - Use-after-free enables heap spraying to replace the freed channel struct, allowing attacker-controlled data to be used as signing keys or function pointers, leading to arbitrary code execution.\nA:H - Use-after-free reliably causes kernel crashes (oops/panic) when the freed channel pointer is dereferenced, causing denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/mgmt/user_session.c", "fs/smb/server/mgmt/user_session.h", "fs/smb/server/smb2pdu.c" ], "versions": [ { "version": "1d9c4172110e645b383ff13eee759728d74f1a5d", "lessThan": "4c2ca31608521895dd742a43beca4b4d29762345", "status": "affected", "versionType": "git" }, { "version": "1d9c4172110e645b383ff13eee759728d74f1a5d", "lessThan": "e4a8a96a93d08570e0405cfd989a8a07e5b6ff33", "status": "affected", "versionType": "git" }, { "version": "1d9c4172110e645b383ff13eee759728d74f1a5d", "lessThan": "36ef605c0395b94b826a8c8d6f2697071173de6e", "status": "affected", "versionType": "git" }, { "version": "1d9c4172110e645b383ff13eee759728d74f1a5d", "lessThan": "4f3a06cc57976cafa8c6f716646be6c79a99e485", "status": "affected", "versionType": "git" }, { "version": "b1caecbf34b8c8260d851ec4efde71f3694460b7", "status": "affected", "versionType": "git" }, { "version": "91bbf9cb2387a0d76322e9a343bc6bc160f66b3f", "status": "affected", "versionType": "git" }, { "version": "853c416710b075153c1e1421e099ffbe5dac68ce", "status": "affected", "versionType": "git" }, { "version": "5.15.145", "lessThan": "5.16", "status": "affected", "versionType": "semver" }, { "version": "6.1.29", "lessThan": "6.2", "status": "affected", "versionType": "semver" }, { "version": "6.2.16", "lessThan": "6.3", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/mgmt/user_session.c", "fs/smb/server/mgmt/user_session.h", "fs/smb/server/smb2pdu.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.11", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.77" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.19.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.0" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.29" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4c2ca31608521895dd742a43beca4b4d29762345" }, { "url": "https://git.kernel.org/stable/c/e4a8a96a93d08570e0405cfd989a8a07e5b6ff33" }, { "url": "https://git.kernel.org/stable/c/36ef605c0395b94b826a8c8d6f2697071173de6e" }, { "url": "https://git.kernel.org/stable/c/4f3a06cc57976cafa8c6f716646be6c79a99e485" } ], "title": "ksmbd: add chann_lock to protect ksmbd_chann_list xarray", "x_generator": { "engine": "bippy-1.2.0" } } } }