01 Record

CVE-2026-74522

ksmbd: fix use-after-free in __close_file_table_ids()

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ksmbd: fix use-after-free in __close_file_table_ids()

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.63% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 50.0% of scored records. A rank, not a probability.
NVD base score: 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Received. NVD last modified this record on 2026-08-19.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-15 12:27Z2 MO AGO

Last updated

2026-08-19 16:38Z2 MO AGO

Reserved

2026-08-15

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-825Expired Pointer DereferenceBase

Data version

5.2

Document digest

0dd54f5912fe5ab2e2c37758743d1af71e9c888d784dcf214cffc590585268a7

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux8510a043d334ecdf83d4604782f288db6bf21d60 to < 19bfd90d5aaf63217735d81964585c5306158e5f, 8510a043d334ecdf83d4604782f288db6bf21d60 to < 67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd, 8510a043d334ecdf83d4604782f288db6bf21d60 to < 0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac, 8510a043d334ecdf83d4604782f288db6bf21d60 to < 9be4a66f019ea90bd9deca70511f4f9ffebf5c6f, 8510a043d334ecdf83d4604782f288db6bf21d60 to < cffbdc86393b0235383a20c8c59bc32f16036459, 8510a043d334ecdf83d4604782f288db6bf21d60 to < e7188199eff46a636f3436356f0aae039be6dd66, df30cbfd3d8a70e61ce59f63ce5ed2261799ac10, aaf1d5ebb358f546414965b39da90107a7ca7ce5, 5.15.38 to < 5.16, 5.17.6 to < 5.18, 5.18—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/19bfd90d5aaf63217735d81964585c5306158e5f
git.kernel.orghttps://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd
git.kernel.orghttps://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac
git.kernel.orghttps://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f
git.kernel.orghttps://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459
git.kernel.orghttps://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1
linux-6.12
Fixed in 6.12.107-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.105-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.8-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.