CVE-2026-72492 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in same_client_has_lease()
same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference.
smb_grant_oplock() then dereferences that pointer in copy_lease() and when checking breaking_cnt. A concurrent close can remove the old lease from ci->m_op_list and drop the last reference before the caller uses the returned pointer, leading to a use-after-free.
Take a reference when same_client_has_lease() selects an existing lease, drop any previous match while scanning, and release the returned reference in smb_grant_oplock() after copying the lease state.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability identified in the Linux kernel affects the ksmbd component which provides SMB/CIFS file sharing capabilities. This issue stems from a use-after-free condition occurring in the same_client_has_lease() function that manages lease operations for SMB clients. The flaw manifests when the function returns an opinfo pointer obtained from the ci->m_op_list list after releasing the ci->m_lock mutex without establishing a proper reference count. This design creates a race condition where concurrent operations can lead to memory corruption.
The technical implementation involves the same_client_has_lease() function performing operations on a shared data structure while holding a lock that gets released before the returned pointer is fully utilized. When smb_grant_oplock() subsequently processes this pointer in copy_lease() function, it accesses memory that may have been deallocated by a concurrent close operation that removes the lease from ci->m_op_list and reduces the reference count. This sequence creates a classic use-after-free scenario where the program attempts to access memory that has already been freed, potentially leading to arbitrary code execution or system instability.
The operational impact of this vulnerability extends beyond simple memory corruption as it represents a critical security flaw that could be exploited by malicious actors. The vulnerability aligns with CWE-416 which describes use-after-free conditions in software systems and maps to ATT&CK technique T1059 where adversaries might leverage such memory corruption vulnerabilities to execute code. The race condition nature of this issue means it can be reliably triggered under concurrent access scenarios typical in network file sharing environments, making it particularly dangerous for production systems.
The fix implementation addresses the root cause by ensuring proper reference counting throughout the operation flow. When same_client_has_lease() identifies an existing lease, it must take a reference to prevent premature deallocation before the pointer is used. During the scanning process, any previous matching entry should have its reference dropped to avoid resource leaks. Finally, in smb_grant_oplock(), after completing the lease state copying operation, the function must release the reference that was acquired earlier. This comprehensive approach ensures proper lifecycle management of the shared objects while maintaining the integrity of the SMB file sharing implementation. The solution follows established security practices for concurrent programming and memory management in kernel space operations, preventing the race condition that leads to the use-after-free scenario.