CVE-2026-23226 (GCVE-0-2026-23226)

Vulnerability from cvelistv5 – Published: 2026-02-18 14:53 – Updated: 2026-08-05 12:20
VLAI
Title
ksmbd: add chann_lock to protect ksmbd_chann_list xarray
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del). Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase accesses.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1d9c4172110e645b383ff13eee759728d74f1a5d , < 4c2ca31608521895dd742a43beca4b4d29762345 (git)
Affected: 1d9c4172110e645b383ff13eee759728d74f1a5d , < e4a8a96a93d08570e0405cfd989a8a07e5b6ff33 (git)
Affected: 1d9c4172110e645b383ff13eee759728d74f1a5d , < 36ef605c0395b94b826a8c8d6f2697071173de6e (git)
Affected: 1d9c4172110e645b383ff13eee759728d74f1a5d , < 4f3a06cc57976cafa8c6f716646be6c79a99e485 (git)
Affected: b1caecbf34b8c8260d851ec4efde71f3694460b7 (git)
Affected: 91bbf9cb2387a0d76322e9a343bc6bc160f66b3f (git)
Affected: 853c416710b075153c1e1421e099ffbe5dac68ce (git)
Affected: 5.15.145 , < 5.16 (semver)
Affected: 6.1.29 , < 6.2 (semver)
Affected: 6.2.16 , < 6.3 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.11 , ≤ 6.18.* (semver)
Unaffected: 6.19.1 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/mgmt/user_session.h",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c2ca31608521895dd742a43beca4b4d29762345",
              "status": "affected",
              "version": "1d9c4172110e645b383ff13eee759728d74f1a5d",
              "versionType": "git"
            },
            {
              "lessThan": "e4a8a96a93d08570e0405cfd989a8a07e5b6ff33",
              "status": "affected",
              "version": "1d9c4172110e645b383ff13eee759728d74f1a5d",
              "versionType": "git"
            },
            {
              "lessThan": "36ef605c0395b94b826a8c8d6f2697071173de6e",
              "status": "affected",
              "version": "1d9c4172110e645b383ff13eee759728d74f1a5d",
              "versionType": "git"
            },
            {
              "lessThan": "4f3a06cc57976cafa8c6f716646be6c79a99e485",
              "status": "affected",
              "version": "1d9c4172110e645b383ff13eee759728d74f1a5d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1caecbf34b8c8260d851ec4efde71f3694460b7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "91bbf9cb2387a0d76322e9a343bc6bc160f66b3f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "853c416710b075153c1e1421e099ffbe5dac68ce",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.29",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/mgmt/user_session.h",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.145",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add chann_lock to protect ksmbd_chann_list xarray\n\nksmbd_chann_list xarray lacks synchronization, allowing use-after-free in\nmulti-channel sessions (between lookup_chann_list() and ksmbd_chann_del).\n\nAdds rw_semaphore chann_lock to struct ksmbd_session and protects\nall xa_load/xa_store/xa_erase accesses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP port 445, directly reachable over the network.\nAC:L - The attacker controls both sides of the race by establishing multiple SMB connections (multi-channel session) and timing a disconnect on one while the other accesses the channel list. The attacker creates and controls the race condition.\nPR:L - The channel list is populated during ntlm_authenticate() or krb5_authenticate(), requiring valid SMB credentials to establish a session before the race can be triggered. This is post-authentication.\nUI:N - No user interaction is needed; the attacker initiates and controls all SMB connections and their timing.\nS:U - The vulnerability and its impact remain within the kernel security authority; no security boundary (e.g., VM, sandbox) is crossed.\nC:H - Use-after-free on struct channel allows reading freed memory that may be reallocated with attacker-controlled content, enabling arbitrary kernel memory disclosure including signing keys.\nI:H - Use-after-free enables heap spraying to replace the freed channel struct, allowing attacker-controlled data to be used as signing keys or function pointers, leading to arbitrary code execution.\nA:H - Use-after-free reliably causes kernel crashes (oops/panic) when the freed channel pointer is dereferenced, causing denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:44.508Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c2ca31608521895dd742a43beca4b4d29762345"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4a8a96a93d08570e0405cfd989a8a07e5b6ff33"
        },
        {
          "url": "https://git.kernel.org/stable/c/36ef605c0395b94b826a8c8d6f2697071173de6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f3a06cc57976cafa8c6f716646be6c79a99e485"
        }
      ],
      "title": "ksmbd: add chann_lock to protect ksmbd_chann_list xarray",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23226",
    "datePublished": "2026-02-18T14:53:29.562Z",
    "dateReserved": "2026-01-13T15:37:45.987Z",
    "dateUpdated": "2026-08-05T12:20:44.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23226",
      "date": "2026-09-23",
      "epss": "0.0044",
      "percentile": "0.37665"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T04:29:02.000Z",
      "cve": "CVE-2026-23226",
      "id": "msrc_CVE-2026-23226",
      "initial_release_date": "2026-02-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: add chann_lock to protect ksmbd_chann_list xarray",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23226.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/mgmt/user_session.c",
                  "fs/smb/server/mgmt/user_session.h",
                  "fs/smb/server/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4c2ca31608521895dd742a43beca4b4d29762345",
                    "status": "affected",
                    "version": "1d9c4172110e645b383ff13eee759728d74f1a5d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e4a8a96a93d08570e0405cfd989a8a07e5b6ff33",
                    "status": "affected",
                    "version": "1d9c4172110e645b383ff13eee759728d74f1a5d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "36ef605c0395b94b826a8c8d6f2697071173de6e",
                    "status": "affected",
                    "version": "1d9c4172110e645b383ff13eee759728d74f1a5d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f3a06cc57976cafa8c6f716646be6c79a99e485",
                    "status": "affected",
                    "version": "1d9c4172110e645b383ff13eee759728d74f1a5d",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b1caecbf34b8c8260d851ec4efde71f3694460b7",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "91bbf9cb2387a0d76322e9a343bc6bc160f66b3f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "853c416710b075153c1e1421e099ffbe5dac68ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "affected",
                    "version": "6.1.29",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "affected",
                    "version": "6.2.16",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/mgmt/user_session.c",
                  "fs/smb/server/mgmt/user_session.h",
                  "fs/smb/server/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.77",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AEB10F82-E8B1-4BB9-B91C-78490070AF53",
                    "versionEndExcluding": "6.18.11",
                    "versionStartIncluding": "6.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EE543C0D-A06B-414F-A403-CB1E088F261E",
                    "versionEndExcluding": "6.19.1",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add chann_lock to protect ksmbd_chann_list xarray\n\nksmbd_chann_list xarray lacks synchronization, allowing use-after-free in\nmulti-channel sessions (between lookup_chann_list() and ksmbd_chann_del).\n\nAdds rw_semaphore chann_lock to struct ksmbd_session and protects\nall xa_load/xa_store/xa_erase accesses."
          },
          {
            "lang": "es",
            "value": "Se ha resuelto la siguiente vulnerabilidad en el kernel de Linux:\n\nksmbd: a\u00f1adir chann_lock para proteger ksmbd_chann_list xarray\n\nksmbd_chann_list xarray carece de sincronizaci\u00f3n, permitiendo uso despu\u00e9s de liberaci\u00f3n en sesiones multicanal (entre lookup_chann_list() y ksmbd_chann_del).\n\nA\u00f1ade el sem\u00e1foro rw_semaphore chann_lock a la estructura ksmbd_session y protege todos los accesos xa_load/xa_store/xa_erase."
          }
        ],
        "id": "CVE-2026-23226",
        "lastModified": "2026-06-17T10:21:08.290",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-02-18T16:22:32.363",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/36ef605c0395b94b826a8c8d6f2697071173de6e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4c2ca31608521895dd742a43beca4b4d29762345"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f3a06cc57976cafa8c6f716646be6c79a99e485"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e4a8a96a93d08570e0405cfd989a8a07e5b6ff33"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T14:21:51+00:00",
      "cve": "CVE-2026-23226",
      "id": "CVE-2026-23226",
      "initial_release_date": "2026-02-18T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (ksmbd): Arbitrary code execution due to use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23226.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:26:39Z",
      "cve": "CVE-2026-23226",
      "id": "CVE-2026-23226",
      "initial_release_date": "2026-02-19T00:26:28Z",
      "product_status:known_not_affected": "332",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23226",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23226.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.