CVE-2026-89788 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix tree connection use-after-free in smb2_tree_connect()
ksmbd_tree_conn_connect() publishes a new tree connection in sess->tree_conns with a single reference and returns its pointer to smb2_tree_connect(). The handler continues to initialize the object and build the response after publication. A concurrent session logoff can erase the connection and drop that reference, freeing the object while the handler still uses it.
BUG: KASAN: slab-use-after-free in smb2_tree_connect+0xe3d/0xf90 smb2_tree_connect (fs/smb/server/smb2pdu.c:2872) handle_ksmbd_work process_one_work worker_thread kthread
After xa_store() succeeds, take a second reference before releasing tree_conns_lock. The original reference belongs to the xarray entry and the second belongs to the creating smb2_tree_connect() handler.
Keep the references balanced in every path:
- On normal exit or an error after publication, smb2_tree_connect() drops its creator reference. Error cleanup also calls ksmbd_tree_conn_disconnect(), which drops the xarray reference only if it removes the exact entry. - SMB2 TREE_DISCONNECT uses the same helper to remove the entry and drop its xarray reference. The request's existing lookup reference remains owned by the request and is released by the existing cleanup. - Session LOGOFF removes each entry and drops its xarray reference. If it wins the race, later cleanup sees that the entry is gone and does not drop that reference again.
To enforce this ownership, claim the disconnected state and erase the exact entry atomically under tree_conns_lock. This guarantees one drop for the xarray reference and one drop by each in-flight user, regardless of which teardown path wins. If logoff removes the entry before initialization completes, fail the connect instead of marking the detached object TREE_CONNECTED.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as a use-after-free flaw within the Linux kernel's ksmbd subsystem specifically affects the smb2_tree_connect function. This issue arises from a race condition during the lifecycle management of tree connection objects. In the standard operational flow, ksmbd_tree_conn_connect publishes a newly created tree connection into the session’s xarray of connections with an initial reference count and returns its pointer to smb2_tree_connect for further initialization. The critical flaw lies in the timing between this publication and the completion of object initialization. During this window, if a concurrent session logoff occurs, it can erase the connection entry from the xarray and drop the associated reference. This action frees the underlying memory structure while the smb2_tree_connect handler is still actively using or referencing that same object, leading to undefined behavior and potential kernel crashes as evidenced by KASAN slab-use-after-free reports.
The root cause of this vulnerability is an imbalance in reference counting ownership during concurrent access scenarios. The original implementation did not adequately protect against a race where the teardown path initiated by a session logoff could complete before the creation path finished initializing the object. When xa_store succeeds, it places the entry into the xarray and holds one reference for that storage mechanism. However, the smb2_tree_connect function also requires its own independent reference to ensure the object remains valid during subsequent operations such as building responses or handling errors. Without a second explicit reference taken immediately after publication but before releasing the tree_conns_lock, there is no guarantee that the object will persist if another thread decides to remove it via logoff logic. This lack of atomicity in reference management allows for a window where the memory can be reclaimed prematurely.
To resolve this issue, the fix implements strict ownership semantics and ensures balanced references across all execution paths. The core modification involves taking a second reference count on the tree connection object immediately after xa_store succeeds but before releasing the tree_conns_lock. This second reference is explicitly owned by the smb2_tree_connect handler, distinguishing it from the xarray storage reference. Consequently, every path that exits normally or encounters an error after publication correctly drops its creator reference. Error cleanup routines invoke ksmbd_tree_conn_disconnect to drop the xarray reference only if they successfully remove the exact entry, preventing double-free scenarios. Similarly, SMB2 TREE_DISCONNECT operations utilize a helper function to atomically remove entries and manage references, while session LOGOFF procedures are updated to claim disconnected state and erase entries under lock protection. This ensures that regardless of which teardown path wins the race condition, there is exactly one drop for the xarray reference and one drop by each in-flight user, maintaining memory safety integrity.
From a security standards perspective, this vulnerability aligns with CWE-416, Use After Free, where program execution continues to use a pointer after it has been freed, potentially leading to arbitrary code execution or denial of service depending on how the kernel handles the stale memory access. In terms of attack vectors, while primarily affecting local stability and availability rather than direct remote exploitation in many contexts, race conditions like this can sometimes be leveraged for privilege escalation if an attacker can control timing to trigger specific heap states. It relates to ATT&CK techniques involving resource hijacking or denial of service through kernel instability. The mitigation strategy emphasizes the importance of atomic operations and precise reference counting in concurrent systems to prevent state corruption during critical initialization phases.
Administrators and developers should ensure that their Linux kernels are updated with patches addressing this ksmbd tree connection race condition. Since this is a kernel-level vulnerability, it requires system-wide updates rather than application-specific fixes. Monitoring for kernel panics or KASAN reports in logs can help identify if systems remain vulnerable before patching. The fix reinforces best practices in concurrent programming by ensuring that resource ownership is clearly defined and protected during the transition from creation to active use, thereby eliminating the window of opportunity for race-based memory corruption attacks.