CVE-2026-23226

ksmbd: add chann_lock to protect ksmbd_chann_list xarray

State: Published
Severity: 8.8 High
Published: Feb 18, 2026
Updated: Oct 30, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add chann_lock to protect ksmbd_chann_list xarray

ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del).

Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase accesses.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	91bbf9cb2387a0d76322e9a343bc6bc160f66b3f to before c00f3938f7ac52770907768e440cf253af9cbb63Affected 1d9c4172110e645b383ff13eee759728d74f1a5d to before 43ad494ac6e940a8eabf25d5bd77bb3bb53b1153Affected 1d9c4172110e645b383ff13eee759728d74f1a5d to before 4c2ca31608521895dd742a43beca4b4d29762345Affected 1d9c4172110e645b383ff13eee759728d74f1a5d to before e4a8a96a93d08570e0405cfd989a8a07e5b6ff33Affected 1d9c4172110e645b383ff13eee759728d74f1a5d to before 36ef605c0395b94b826a8c8d6f2697071173de6eAffected 1d9c4172110e645b383ff13eee759728d74f1a5d to before 4f3a06cc57976cafa8c6f716646be6c79a99e485Affected b1caecbf34b8c8260d851ec4efde71f3694460b7Affected 853c416710b075153c1e1421e099ffbe5dac68ceAffected 6.1.29 to before 6.1.191Affected 5.15.145 to before 5.16Affected 6.2.16 to before 6.3Affected
LinuxLinux	6.3Affected before 6.3Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.11 through 6.18.Not affected 6.19.1 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

91bbf9cb2387a0d76322e9a343bc6bc160f66b3f to before c00f3938f7ac52770907768e440cf253af9cbb63Affected
1d9c4172110e645b383ff13eee759728d74f1a5d to before 43ad494ac6e940a8eabf25d5bd77bb3bb53b1153Affected
1d9c4172110e645b383ff13eee759728d74f1a5d to before 4c2ca31608521895dd742a43beca4b4d29762345Affected
1d9c4172110e645b383ff13eee759728d74f1a5d to before e4a8a96a93d08570e0405cfd989a8a07e5b6ff33Affected
1d9c4172110e645b383ff13eee759728d74f1a5d to before 36ef605c0395b94b826a8c8d6f2697071173de6eAffected
1d9c4172110e645b383ff13eee759728d74f1a5d to before 4f3a06cc57976cafa8c6f716646be6c79a99e485Affected
b1caecbf34b8c8260d851ec4efde71f3694460b7Affected
853c416710b075153c1e1421e099ffbe5dac68ceAffected
6.1.29 to before 6.1.191Affected
5.15.145 to before 5.16Affected
6.2.16 to before 6.3Affected

LinuxLinux

6.3Affected
before 6.3Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.11 through 6.18.*Not affected
6.19.1 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.