Riskcovery

CVE-2026-43379

ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()

State
Published
Severity
9.8 Critical
Published
May 8, 2026
Updated
Aug 5, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()

opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is being accessed after rcu_read_unlock() has been called. This creates a race condition where the memory could be freed by a concurrent writer between the unlock and the subsequent pointer dereferences (opinfo->is_lease, etc.), leading to a use-after-free.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 27b40b7bfcd121fe13a150ffe11957630cf49246 to before bf4d66d72e4a9e268c1012c331ce9eaedb5e2086Affected
  • 5fb282ba4fef8985a5acf2b32681f2ec07732561 to before 960699317d39f46611f4ebeb69edc567c1f4e6b6Affected
  • 5fb282ba4fef8985a5acf2b32681f2ec07732561 to before dbbd328cf58261ca239756fe1c0d10c9518d3399Affected
  • 5fb282ba4fef8985a5acf2b32681f2ec07732561 to before b3568347c51c46e2cabc356bc34676df98296619Affected
  • 5fb282ba4fef8985a5acf2b32681f2ec07732561 to before eac3361e3d5dd8067b3258c69615888eb45e9f25Affected
  • 6.6.32 to before 6.6.130Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.6.130 through 6.6.*Not affected
  • 6.12.78 through 6.12.*Not affected
  • 6.18.19 through 6.18.*Not affected
  • 6.19.9 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.