Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:57.433Z",
  "pubdate": "2026-08-15T13:17:57.433Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's ksmbd server implementation, specifically within file table management functions such as __close_file_table_ids() and ksmbd_close_fd(). This flaw is classified as a use-after-free vulnerability, which can lead to memory corruption, potential kernel crashes, or arbitrary code execution within the operating system kernel.\nThe vulnerability affects the Linux kernel ksmbd subsystem when handling file closures across multiple sessions. The risk implications are severe, as kernel-level memory corruption typically results in a denial of service or potential privilege escalation for malicious actors.\nAttacker capabilities depend on the ability to interact with the ksmbd server and manipulate sessions and file descriptors. Exploitation requires the capacity to establish sessions, hold temporary references via ksmbd_lookup_fd_inode(), and coordinate foreign ksmbd_fd_put() operations to trigger improper object lifecycle management and stale pointer dereferencing during file-table teardown.",
  "technicalDetails": "The root cause of this vulnerability lies in improper reference tracking and idr management within the ksmbd file descriptor handling logic. Specifically, a ksmbd_file object can remain logically alive after a logical close operation if another session holds a temporary reference obtained via ksmbd_lookup_fd_inode().\nDuring the execution of ksmbd_close_fd(), the subsystem marks the file as closed and drops the idr-owned reference. However, it erroneously leaves the pointer published in the closing session's idr until the final reference is completely dropped.\nWhen a foreign session holding a temporary reference performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). As a result, the memory object is freed without being removed from its original owner's idr. Subsequently, when the owner session undergoes file-table teardown, it dereferences the stale pointer, triggering a use-after-free condition.\nThe vulnerable components include the file handling and session management functions within ksmbd, notably __close_file_table_ids(), ksmbd_close_fd(), and __ksmbd_lookup_fd_inode().\nStep-by-step exploitation flow involves: (1) An owner session opens a file and a foreign session acquires a temporary reference through ksmbd_lookup_fd_inode(); (2) The owner session calls ksmbd_close_fd(), which marks the file closed and drops the idr reference while leaving the pointer in the idr; (3) The foreign session drops its final reference via ksmbd_fd_put(), causing __put_fd_final() to free the underlying object prematurely from the wrong context; (4) The owner session later attempts file-table teardown, dereferencing the stale pointer left in its idr and inducing a kernel crash or memory corruption."
}