CVE-2026-74522 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in __close_file_table_ids()
A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped.
If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown.
Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel represents a critical use-after-free condition within the ksmbd subsystem that affects SMB file sharing operations. This flaw exists specifically in the __close_file_table_ids() function where proper synchronization and resource cleanup mechanisms fail to prevent concurrent access patterns that lead to memory corruption. The issue stems from improper handling of file descriptor references during the closing process, creating a scenario where objects remain accessible in memory even after they should have been freed, thereby exposing the system to potential exploitation.
The technical root cause involves a race condition between multiple sessions managing file descriptors through the ksmbd subsystem. When a session performs a logical close operation via ksmbd_close_fd(), it marks the file as closed and drops its own reference to the file descriptor structure. However, the pointer to this file remains published in the closing session's internal identifier reference table (idr) until all external references are released. Meanwhile, another session may have obtained a temporary reference through ksmbd_lookup_fd_inode() function, creating a scenario where concurrent access patterns can lead to memory corruption. This design flaw violates fundamental principles of memory management and synchronization, as the system does not properly coordinate between different sessions accessing the same resource.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation and system compromise. Attackers could exploit this condition by carefully orchestrating concurrent file operations across multiple sessions, leading to undefined behavior when the stale pointer is eventually dereferenced during file table teardown. The vulnerability creates opportunities for attackers to execute arbitrary code or cause denial of service conditions within the kernel space, making it particularly dangerous in production environments where ksmbd serves SMB shares. This issue directly aligns with CWE-416, which describes use-after-free vulnerabilities that occur when memory is accessed after it has been freed.
The recommended mitigation strategy involves implementing proper synchronization mechanisms during file descriptor cleanup operations by removing the volatile identifier from the owner's internal reference table while still holding the necessary locks. The fix requires clearing the volatile_id field before dropping the idr-owned reference, ensuring that any subsequent final reference releases only perform physical destruction without attempting to remove objects from incorrect tables. This approach follows established security practices for concurrent resource management and eliminates the window of vulnerability where stale pointers could be dereferenced. The solution addresses fundamental issues in kernel memory management patterns and provides a robust mechanism for preventing similar race conditions in related subsystems, aligning with ATT&CK technique T1068 which covers local privilege escalation through kernel vulnerabilities.
The fix demonstrates proper adherence to kernel security principles by ensuring that resource cleanup operations maintain atomicity and consistency across concurrent access patterns. The implementation requires careful attention to locking mechanisms and reference counting procedures to prevent the race condition that enabled this vulnerability. This type of vulnerability represents a classic example of how improper synchronization in kernel subsystems can create exploitable conditions, emphasizing the importance of rigorous code review processes for security-critical components like network file sharing services.