CVE-2026-72492 - Vulnerability Details

- ksmbd: fix use-after-free in same_client_has_lease()

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in same_client_has_lease()

same_client_has_lease() returns an opinfo pointer from ci->m_op_list
after dropping ci->m_lock without taking a reference.

smb_grant_oplock() then dereferences that pointer in copy_lease() and
when checking breaking_cnt. A concurrent close can remove the old lease
from ci->m_op_list and drop the last reference before the caller uses
the returned pointer, leading to a use-after-free.

Take a reference when same_client_has_lease() selects an existing lease,
drop any previous match while scanning, and release the returned
reference in smb_grant_oplock() after copying the lease state.

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ksmbd module of the Linux kernel contains a use‑after‑free defect. The function same_client_has_lease() returns an opinfo pointer without taking a reference after releasing a lock. If smb_grant_oplock() later dereferences that stale pointer, a concurrent close can free the lease and drop the last reference, resulting in kernel memory corruption. This flaw is classified as CWE‑825 and can potentially allow arbitrary kernel memory corruption, which may lead to elevated privileges.

Affected Systems

The vulnerability is present in the Linux kernel’s ksmbd SMB server component. It affects any distribution that ships the ksmbd code unchanged. No specific kernel version range is given.

Risk and Exploitability

The advisory assigns a CVSS score of 8.8, indicating a high severity, while the EPSS score is reported as < 1%, suggesting a low likelihood of exploitation at present. The flaw is not listed in CISA KEV. Based on the description, it is inferred that a remote SMB client could trigger the flaw, giving the attacker a path to kernel memory corruption and, potentially, root privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 09634cd055d9bd8dd167995ea52bcd8028dd5dac
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 7c3264d273d524aa6adcce23c01087271f13586f
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 79c7c59bb519db6f5a2a151965e825ec725614cc
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 0ff82a9cf9312678d8bc4edeef0b6e82659ac12a
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 65b655f65c3ca1ab5d598d3832bb0ff531725858

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0]`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,09634cd055d9bd8dd167995ea52bcd8028dd5dac]`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,7c3264d273d524aa6adcce23c01087271f13586f]`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,79c7c59bb519db6f5a2a151965e825ec725614cc]`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d]`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,0ff82a9cf9312678d8bc4edeef0b6e82659ac12a]`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,65b655f65c3ca1ab5d598d3832bb0ff531725858]`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	generic	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the ksmbd use‑after‑free fix.
Disable the ksmbd service or block SMB traffic from untrusted hosts until the patch is applied.
Enable kernel hardening features such as KASLR and signed module enforcement to raise the exploitation bar.
Monitor kernel logs for abnormal SMB or kernel activity and apply any interim mitigations released by the Linux community.

Generated by OpenCVE AI on August 22, 2026 at 03:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00477.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/09634cd055d9bd8dd167995ea52bcd8028dd5dac
https://git.kernel.org/stable/c/0ff82a9cf9312678d8bc4edeef0b6e82659ac12a
https://git.kernel.org/stable/c/35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d
https://git.kernel.org/stable/c/65b655f65c3ca1ab5d598d3832bb0ff531725858
https://git.kernel.org/stable/c/79c7c59bb519db6f5a2a151965e825ec725614cc
https://git.kernel.org/stable/c/7c3264d273d524aa6adcce23c01087271f13586f
https://git.kernel.org/stable/c/aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0
https://lore.kernel.org/linux-cve-announce/2026081539-CVE-2026-72492-b49b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72492
https://www.cve.org/CVERecord?id=CVE-2026-72492

History

Wed, 19 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081539-CVE-2026-72492-b49b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72492 https://www.cve.org/CVERecord?id=CVE-2026-72492
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in same_client_has_lease() same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. smb_grant_oplock() then dereferences that pointer in copy_lease() and when checking breaking_cnt. A concurrent close can remove the old lease from ci->m_op_list and drop the last reference before the caller uses the returned pointer, leading to a use-after-free. Take a reference when same_client_has_lease() selects an existing lease, drop any previous match while scanning, and release the returned reference in smb_grant_oplock() after copying the lease state.
Title		ksmbd: fix use-after-free in same_client_has_lease()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/09634cd055d9bd8dd167995ea52bcd8028dd5dac https://git.kernel.org/stable/c/0ff82a9cf9312678d8bc4edeef0b6e82659ac12a https://git.kernel.org/stable/c/35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d https://git.kernel.org/stable/c/65b655f65c3ca1ab5d598d3832bb0ff531725858 https://git.kernel.org/stable/c/79c7c59bb519db6f5a2a151965e825ec725614cc https://git.kernel.org/stable/c/7c3264d273d524aa6adcce23c01087271f13586f https://git.kernel.org/stable/c/aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:26.967Z

Updated: 2026-08-17T05:44:53.329Z

Reserved: 2026-08-09T03:40:39.936Z

Link: CVE-2026-72492

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:23.533

Modified: 2026-08-17T06:19:17.553

Link: CVE-2026-72492

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72492 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T03:15:04Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object