Look up another CVE · open CVE-2026-53010 in the interactive tracker
CVE-2026-53010
ksmbd: fix use-after-free in smb2_open during durable reconnect
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53010 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-free when accessing fp properties (eg fp->create_time). Move the single put to the end of the function below err_out2 so fp stays valid until smb2_open returns.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/server/smb2pdu.c
- What this is
- KERNEL SMB3 SERVER (KSMBD)MAINTAINERS section matched on fs/smb/server/ · linux-cifs@vger.kernel.org · Maintained
- Kernel module
- ksmbd
Check it on the machine
grep -wE 'CONFIG_SMBFS|CONFIG_SMB_SERVER' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ksmbdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_SMBFS, CONFIG_SMB_SERVER
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.44%, higher than 37.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.6.32 | 6.6.157 | f0ff7f12398e |
| 6.9 | 6.12.110 | 4db3dcac84c2 |
| 6.9 | 6.18.33 | ce2e164c1c51 |
| 6.9 | 7.0.10 | 97a0cd55283b |
| 6.9 | 7.1 | 1baff47b81f9 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- ksmbd is an in-kernel SMB server reachable over TCP, and SMB2_CREATE requests are dispatched from network-received SMB packets to smb2_open. The durable reconnect path is therefore remotely reachable over the network.
- AC:LAttack complexity, low
- An attacker can drive the required SMB sequence by creating a durable handle, disconnecting, and sending a durable reconnect request with controlled create contexts. The bug is a use-after-free/lifetime error in the request path, not a race depending on conditions outside the attacker's control.
- PR:NPrivileges required, none
- Although SMB2_CREATE requires a valid session and tree connect, ksmbd supports guest/anonymous users and guest shares, so a reasonable guest-enabled deployment lets an unauthenticated network client satisfy those gates. Scoring uses that highest reasonable exposure.
- UI:NUser interaction, none
- No victim user action is required once ksmbd is listening and the share is available. The attacker sends SMB protocol messages directly.
- S:UScope, unchanged
- The vulnerability is in the kernel SMB server and impacts the same kernel/server security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.
- C:HConfidentiality impact, high
- The bug is a use-after-free of struct ksmbd_file, which contains kernel pointers, file state, IDs, GUIDs, and list links. Kernel UAF memory corruption can be leveraged for information disclosure, so confidentiality impact is high.
- I:HIntegrity impact, high
- Use-after-free in kernel heap objects can be exploited through heap shaping and stale pointer reuse to corrupt kernel state or hijack control flow. Integrity impact is therefore high.
- A:HAvailability impact, high
- The stale ksmbd_file can be dereferenced or closed after free on reconnect/error/scavenger paths, which can crash or destabilize the kernel. Availability impact is high.