Linux Kernel up to 6.18.10/6.19.0 ksmbd lookup_chann_list use after free

Summaryinfo

A vulnerability described as critical has been identified in Linux Kernel up to 6.18.10/6.19.0. The impacted element is the function lookup_chann_list of the component ksmbd. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2026-23226. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.18.10/6.19.0 and classified as critical. This vulnerability affects the function lookup_chann_list of the component ksmbd. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del). Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase accesses.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-23226 since 01/13/2026. The exploitation appears to be easy. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/24/2026).

The vulnerability scanner Nessus provides a plugin with the ID 299441 (Linux Distros Unpatched Vulnerability : CVE-2026-23226), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.11 or 6.19.1 eliminates this vulnerability. Applying the patch e4a8a96a93d08570e0405cfd989a8a07e5b6ff33/36ef605c0395b94b826a8c8d6f2697071173de6e is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (299441), EUVD (EUVD-2026-7675) and CERT Bund (WID-SEC-2026-0462). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 6.17
• 6.18
• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.19.0

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion