Look up another CVE · open CVE-2026-72492 in the interactive tracker
CVE-2026-72492
ksmbd: fix use-after-free in same_client_has_lease()
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72492 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. smb_grant_oplock() then dereferences that pointer in copy_lease() and when checking breaking_cnt. A concurrent close can remove the old lease from ci->m_op_list and drop the last reference before the caller uses the returned pointer, leading to a use-after-free. Take a reference when same_client_has_lease() selects an existing lease, drop any previous match while scanning, and release the returned reference in smb_grant_oplock() after copying the lease state.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/server/oplock.c
- What this is
- KERNEL SMB3 SERVER (KSMBD)MAINTAINERS section matched on fs/smb/server/ · linux-cifs@vger.kernel.org · Maintained
- Kernel module
- ksmbd
Check it on the machine
grep -wE 'CONFIG_SMBFS|CONFIG_SMB_SERVER' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ksmbdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_SMBFS, CONFIG_SMB_SERVER
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.64%, higher than 49.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.15 | 5.15.212 | aaa3bb2bbf2c |
| 5.15 | 6.1.178 | 09634cd055d9 |
| 5.15 | 6.6.145 | 7c3264d273d5 |
| 5.15 | 6.12.97 | 79c7c59bb519 |
| 5.15 | 6.18.40 | 35d3d6ff2bc1 |
| 5.15 | 7.1.5 | 0ff82a9cf931 |
| 5.15 | 7.2 | 65b655f65c3c |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- ksmbd is the in-kernel SMB server on TCP/445; the UAF is reached when a remote client sends SMB2_CREATE with a lease context, handled via ksmbd_conn_handler_loop() through smb2_open() and smb_grant_oplock() into same_client_has_lease().
- AC:LAttack complexity, low
- The attacker controls both sides of the race by holding a leased open on one SMB connection while concurrently issuing SMB2_CREATE (lease upgrade) and SMB2_CLOSE on another connection or channel; no victim-dependent timing or memory layout is required.
- PR:LPrivileges required, low
- Exploitation requires a valid SMB2 session, tree connect, and share permission to open/close the target file with SMB3 leasing enabled; smb2_check_user_session() rejects SMB2_CREATE without SMB2_SESSION_VALID, so this is not reachable on pre-authentication negotiate/echo paths.
- UI:NUser interaction, none
- No victim interaction is required; the attacker drives all SMB2_CREATE and SMB2_CLOSE operations on their own client connection(s) to trigger the concurrent lease lookup and file close.
- S:UScope, unchanged
- Impact is kernel heap corruption and privilege escalation on the SMB server host within the ksmbd/kernel security authority; it does not cross a VM, container, or IOMMU boundary.
- C:HConfidentiality impact, high
- Use-after-free of a freed oplock_info/lease object in copy_lease() reads attacker-influenced slab contents (level, lease state, keys, flags, epoch), enabling kernel memory disclosure and arbitrary-read primitive construction.
- I:HIntegrity impact, high
- The UAF dereferences freed oplock_info and embedded lease pointers during copy_lease() and breaking_cnt checks, enabling heap grooming and memory corruption exploitable for arbitrary write or control-flow hijack as root.
- A:HAvailability impact, high
- Concurrent close can free the oplock_info before smb_grant_oplock() uses it, causing reliable kernel memory corruption, oops, or panic and repeatable remote denial of service against the server.