CVE-2026-89635

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: only rebind the reopened file's own oplock on durable reconnect

ksmbd_reopen_durable_fd() walks the inode's m_op_list and rebinds every detached oplock to the reconnecting session:

The only key is op->conn == NULL, which every detached durable handle on that inode matches, not just the one owned by fp. When two sessions hold durable handles on the same file and both disconnect, reconnecting one of them adopts the other session's oplock: op->sess is overwritten with the reconnecting session without taking a reference on it, while op->conn pins the connection.

Leer descripción completaMostrar menos

The sibling teardown path, session_fd_check(), keys on the identity of the connection being torn down (op->conn == conn) rather than on shared state, and so does not have this problem.

Once the adopting session is destroyed, ksmbd_session_destroy() frees it while the foreign oplock still points at it. The reader in ksmbd_close_fd_app_instance_id() validates only opinfo->conn, which is still live thanks to the reference taken above, and then dereferences the stale session:

Reached from an authenticated session against a share with the default durable-handle and oplock configuration: two sessions open the same file with a durable-v2 handle and an RH lease under distinct AppInstanceIds, both log off, one reconnects with DH2C, and a later durable-v2 create carrying the other AppInstanceId walks into the freed session.

Constrain the loop to the oplock owned by the file being reopened.

Detalles técnicos trazas, registros y código del informe original

	list_for_each_entry_rcu(op, &ci->m_op_list, op_entry,
				lockdep_is_held(&ci->m_lock)) {
		if (op->conn)
			continue;
		op->conn = ksmbd_conn_get(fp->conn);
		op->sess = work->sess;
	}

	if (!opinfo->conn) {
		up_read(&fp->f_ci->m_lock);
		goto out;
	}

	ft = &opinfo->sess->file_table;
	write_lock(&ft->lock);

  BUG: KASAN: slab-use-after-free in _raw_write_lock+0x74/0xd0
  Write of size 4 at addr ffff88810a970528 by task kworker/0:0/9
  Workqueue: ksmbd-io handle_ksmbd_work
  Call Trace:
   _raw_write_lock+0x74/0xd0
   ksmbd_close_fd_app_instance_id+0x183/0x410
   smb2_open+0x1346/0x4430
   handle_ksmbd_work+0x2bb/0x7b0

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.55%
Percentil entre todas las CVEs puntuadas: 44
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1068 Exploitation for Privilege Escalationprivilege escalation75 %
Impacto secundarioT1499.004 Application or System Exploitationimpact70 %

Vulnerabilidad en ksmbd (servidor SMB en kernel Linux) alcanzable remotamente sin autenticación previa según CVSS AV:N/PR:N. Permite escalada de privilegios mediante corrupción de memoria (use-after-free) tras desconexión de sesión, causando DoS potencial.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Application Isolation and Sandboxing Exploit Protection Update Software Vulnerability Scanning Threat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-89635",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f363a0fb134a3eb9e47368b1edbd251fd76be84b",
              "lessThan": "74e3ef4630f004c0de40c0540648a5a4033c6c9d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f363a0fb134a3eb9e47368b1edbd251fd76be84b",
              "lessThan": "3f220a0a62e6b9b391c9d1f0e6580b05173cc7f7",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/smb/server/vfs_cache.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/smb/server/vfs_cache.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:49.120",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3f220a0a62e6b9b391c9d1f0e6580b05173cc7f7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/74e3ef4630f004c0de40c0540648a5a4033c6c9d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: only rebind the reopened file's own oplock on durable reconnect\n\nksmbd_reopen_durable_fd() walks the inode's m_op_list and rebinds every\ndetached oplock to the reconnecting session:\n\n\tlist_for_each_entry_rcu(op, &ci->m_op_list, op_entry,\n\t\t\t\tlockdep_is_held(&ci->m_lock)) {\n\t\tif (op->conn)\n\t\t\tcontinue;\n\t\top->conn = ksmbd_conn_get(fp->conn);\n\t\top->sess = work->sess;\n\t}\n\nThe only key is op->conn == NULL, which every detached durable handle on\nthat inode matches, not just the one owned by fp.  When two sessions hold\ndurable handles on the same file and both disconnect, reconnecting one of\nthem adopts the other session's oplock: op->sess is overwritten with the\nreconnecting session without taking a reference on it, while op->conn\npins the connection.\n\nThe sibling teardown path, session_fd_check(), keys on the identity of\nthe connection being torn down (op->conn == conn) rather than on shared\nstate, and so does not have this problem.\n\nOnce the adopting session is destroyed, ksmbd_session_destroy() frees it\nwhile the foreign oplock still points at it.  The reader in\nksmbd_close_fd_app_instance_id() validates only opinfo->conn, which is\nstill live thanks to the reference taken above, and then dereferences the\nstale session:\n\n\tif (!opinfo->conn) {\n\t\tup_read(&fp->f_ci->m_lock);\n\t\tgoto out;\n\t}\n\n\tft = &opinfo->sess->file_table;\n\twrite_lock(&ft->lock);\n\n  BUG: KASAN: slab-use-after-free in _raw_write_lock+0x74/0xd0\n  Write of size 4 at addr ffff88810a970528 by task kworker/0:0/9\n  Workqueue: ksmbd-io handle_ksmbd_work\n  Call Trace:\n   _raw_write_lock+0x74/0xd0\n   ksmbd_close_fd_app_instance_id+0x183/0x410\n   smb2_open+0x1346/0x4430\n   handle_ksmbd_work+0x2bb/0x7b0\n\nReached from an authenticated session against a share with the default\ndurable-handle and oplock configuration: two sessions open the same file\nwith a durable-v2 handle and an RH lease under distinct AppInstanceIds,\nboth log off, one reconnects with DH2C, and a later durable-v2 create\ncarrying the other AppInstanceId walks into the freed session.\n\nConstrain the loop to the oplock owned by the file being reopened."
    }
  ],
  "lastModified": "2026-09-13T07:17:28.657",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}