Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-43379

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is being accessed after rcu_read_unlock() has been called. This creates a race condition where the memory could be freed by a concurrent writer between the unlock and the subsequent pointer dereferences (opinfo->is_lease, etc.), leading to a use-after-free.

View on NVD

Analysis

A critical vulnerability has been identified in the Linux kernel SMB server (ksmbd) that could allow remote attackers to execute code with kernel privileges. This use-after-free flaw occurs during the handling of SMB lease breaks and should be patched immediately on any systems utilizing the kernel-mode SMB server.

Relevant roles

LinuxCyberSecurityBackendDockerKubernetesCloud

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-416

EPSS

Probability of exploitation (next 30 days): 0.0006 (0.1%)
Percentile: 18.8%
EPSS: 2026-05-19

Affects

linux:linux_kernel

Technical description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is being accessed after rcu_read_unlock() has been called. This creates a race condition where the memory could be freed by a concurrent writer between the unlock and the subsequent pointer dereferences (opinfo->is_lease, etc.), leading to a use-after-free.

Published: 5/8/2026, 3:16:49 PM
Last modified: 5/19/2026, 7:56:32 PM

References

HomeEventsBlogResourcesTeam