CVE-2026-68381 - Vulnerability Details

- ksmbd: pin conn during async oplock break notification

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: pin conn during async oplock break notification

smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn
pointer in an async ksmbd_work and then queue that work on ksmbd-io. The
work only increments conn->r_count, which prevents teardown from passing
the pending-request wait after the increment, but it does not pin the
struct ksmbd_conn object.

If connection teardown races with an oplock break notification, the last
conn reference can be dropped before the queued worker finishes. The
worker then uses the freed conn in ksmbd_conn_write() and
ksmbd_conn_r_count_dec().

Take a real conn reference when publishing the conn pointer to the async
work item, and drop it after the notification work has decremented
r_count. Apply the same lifetime rule to lease break notification, which
uses the same work->conn pattern.

Published: 2026-08-10

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a use‑after‑free flaw in the ksmbd SMB daemon. When an oplock or lease break notification is processed asynchronously, the worker retains a ksmbd_conn pointer but does not pin the reference. If the connection is torn down at the same time, the last reference may be released before the worker finishes. The worker then uses the freed object in write and reference‑decrement operations, corrupting kernel memory. Based on the description, this race could lead to unintended kernel behavior and potentially privilege escalation, though no exploit has been documented.

Affected Systems

All Linux distributions that ship the Linux kernel with the ksmbd SMB server component are potentially affected. No specific kernel version is listed, so systems running any kernel that includes ksmbd are at risk until the upstream patch is applied.

Risk and Exploitability

The flaw has a CVSS score of 9.8, indicating a high severity. The EPSS score of < 1% reflects a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is remote SMB access, inferred because ksmbd is an SMB server; however, the CVE entry does not provide a documented exploitation path.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8e6508c7ecb1802909f294827eff38f301d0c937`	affected	< dab1493bc9d97947f1219d6823c2e2a28636021b
`09aeab68033161cb54f194da93e51a11aee6144b`	affected	< 0f72fc9659d7f585460d43c158055df5afdcffb6
`a4261bbc33fbf99b99c80aa3a2c5097611802980`	affected	< 793e1c7041b93af96ff87e678329bc16aee7ba88
`3aa660c059240e0c795217182cf7df32909dd917`	affected	< 6ecb252efa0b413ac3d9979fb4eec247f8fc1258
`3aa660c059240e0c795217182cf7df32909dd917`	affected	< 14062c74e5b25c27edcff7a2fe0dc701c930b372
`3aa660c059240e0c795217182cf7df32909dd917`	affected	< aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9
`f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa`	affected	—
`6.6.84`	affected	< 6.6.148
`6.12.20`	affected	< 6.12.101
`6.13.8`	affected	< 6.14

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[09aeab68033161cb54f194da93e51a11aee6144b,0f72fc9659d7f585460d43c158055df5afdcffb6)`	affected	code_commit	—
`[a4261bbc33fbf99b99c80aa3a2c5097611802980,793e1c7041b93af96ff87e678329bc16aee7ba88)`	affected	code_commit	—
`[3aa660c059240e0c795217182cf7df32909dd917,6ecb252efa0b413ac3d9979fb4eec247f8fc1258)`	affected	code_commit	—
`[3aa660c059240e0c795217182cf7df32909dd917,14062c74e5b25c27edcff7a2fe0dc701c930b372)`	affected	code_commit	—
`[3aa660c059240e0c795217182cf7df32909dd917,aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9)`	affected	code_commit	—
`f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa`	affected	code_commit	—
`[6.6.84,6.6.148)`	affected	semver	—
`[6.12.20,6.12.101)`	affected	semver	—
`[6.13.8,6.14)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.14`	affected	semver	—
`[0,6.14)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains the ksmbd use‑after‑free patch.
If a kernel update is not yet available, disable the ksmbd service to remove the attack surface.
Monitor system logs for abnormal kernel events that may indicate exploitation attempts.

Generated by OpenCVE AI on October 20, 2026 at 11:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8887-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8889-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8887-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8887-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00457.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/0f72fc9659d7f585460d43c158055df5afdcffb6
https://git.kernel.org/stable/c/14062c74e5b25c27edcff7a2fe0dc701c930b372
https://git.kernel.org/stable/c/6ecb252efa0b413ac3d9979fb4eec247f8fc1258
https://git.kernel.org/stable/c/793e1c7041b93af96ff87e678329bc16aee7ba88
https://git.kernel.org/stable/c/aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9
https://git.kernel.org/stable/c/dab1493bc9d97947f1219d6823c2e2a28636021b
https://nvd.nist.gov/vuln/detail/CVE-2026-68381
https://www.cve.org/CVERecord?id=CVE-2026-68381

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/dab1493bc9d97947f1219d6823c2e2a28636021b

Mon, 19 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 17 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 13 Aug 2026 23:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68381 https://www.cve.org/CVERecord?id=CVE-2026-68381
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Mon, 10 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object. If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes. The worker then uses the freed conn in ksmbd_conn_write() and ksmbd_conn_r_count_dec(). Take a real conn reference when publishing the conn pointer to the async work item, and drop it after the notification work has decremented r_count. Apply the same lifetime rule to lease break notification, which uses the same work->conn pattern.
Title		ksmbd: pin conn during async oplock break notification
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f72fc9659d7f585460d43c158055df5afdcffb6 https://git.kernel.org/stable/c/14062c74e5b25c27edcff7a2fe0dc701c930b372 https://git.kernel.org/stable/c/6ecb252efa0b413ac3d9979fb4eec247f8fc1258 https://git.kernel.org/stable/c/793e1c7041b93af96ff87e678329bc16aee7ba88 https://git.kernel.org/stable/c/aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:03:59.849Z

Updated: 2026-10-30T12:28:25.660Z

Reserved: 2026-07-30T09:28:09.387Z

Link: CVE-2026-68381

Vulnrichment

Updated: 2026-10-16T15:47:41.521Z

NVD

Status : Received

Published: 2026-08-10T13:20:31.197

Modified: 2026-10-30T13:19:43.910

Link: CVE-2026-68381

Redhat

Severity : Important

Publid Date: 2026-08-10T12:03:59Z

Links: CVE-2026-68381 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T11:15:14Z

Weaknesses

CWE-364
Signal Handler Race Condition
CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object