CVE-2026-23427: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23427 is a use-after-free vulnerability in the Linux kernel's ksmbd (kernel SMB server) component, specifically in the handling of durable v2 replay of active SMB2 file handles. The flaw was published on April 3, 2026, and affects Linux kernel versions 6.6.32 through 6.6.130, 6.9.1 through 6.12.78, 6.13 through 6.18.20, 6.19 through 6.19.10, and various 7.0 release candidates. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a use-after-free (CWE-416) in parse_durable_handle_context(), which unconditionally overwrites dh_info->fp->conn with the current connection pointer when processing an SMB2 DURABLE_REQ_V2 context bearing the SMB2_FLAGS_REPLAY_OPERATION flag. Because ksmbd_lookup_fd_cguid() does not filter returned file handles by fp->conn, it can return handles already actively associated with another connection. When the overwriting connection is subsequently freed via ksmbd_tcp_disconnect(), __ksmbd_close_fd() dereferences the now-stale fp->conn pointer through spin_lock(&fp->conn->llist_lock), triggering the use-after-free. A KASAN report confirms a slab-use-after-free write of 4 bytes in _raw_spin_lock executed from the ksmbd-io workqueue (GitHub Advisory).

Successful exploitation can result in kernel memory corruption leading to kernel panics (denial of service), or potentially arbitrary code execution at kernel privilege level. An attacker who can send crafted SMB2 requests with DURABLE_REQ_V2 context to a ksmbd-enabled server could destabilize the host, disrupt SMB file-sharing services, or escalate to full system compromise with high confidentiality, integrity, and availability impact. Any system using ksmbd for SMB/CIFS file sharing is potentially affected (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), placing it in a low exploitation-probability tier. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges and local (network) access to an SMB service running ksmbd, making it accessible to authenticated SMB clients (GitHub Advisory, Feedly).

1. Reconnaissance: Identify target systems running Linux with ksmbd enabled and exposing SMB services (TCP port 445), using network scanners such as Nmap or Shodan to locate vulnerable kernel versions (6.6.32–6.6.130, 6.9.1–6.12.78, 6.13–6.18.20, 6.19–6.19.10, or 7.0-rc1 through rc7).
2. Authenticate to SMB service: Obtain low-privilege SMB credentials (or use guest access if permitted) to establish an initial SMB2 session with the target ksmbd server.
3. Open a durable file handle: Create an SMB2 file open request with a DURABLE_REQ_V2 context to establish a durable file handle associated with the attacker's connection.
4. Trigger replay with a second connection: From a second SMB2 connection, send a crafted SMB2 CREATE request with DURABLE_REQ_V2 context and the SMB2_FLAGS_REPLAY_OPERATION flag set, referencing the GUID of the existing durable handle. This causes parse_durable_handle_context() to overwrite fp->conn with the new connection pointer.
5. Trigger connection teardown: Disconnect the second (overwriting) connection, causing ksmbd_tcp_disconnect() to free the connection object while fp->conn still references it.
6. Trigger use-after-free: Initiate a close or further operation on the file handle from the original connection, causing __ksmbd_close_fd() to dereference the freed fp->conn pointer, resulting in kernel memory corruption, a potential kernel panic, or exploitable code execution (GitHub Advisory, Feedly).

• Network: Unusual or repeated SMB2 CREATE requests to port 445 with DURABLE_REQ_V2 context and SMB2_FLAGS_REPLAY_OPERATION flags from the same or multiple source IPs; rapid SMB session establishment and teardown sequences.
• Logs: Kernel logs (dmesg, /var/log/kern.log) showing KASAN reports with BUG: KASAN: slab-use-after-free in _raw_spin_lock; kernel oops or panic traces referencing __ksmbd_close_fd, ksmbd_close_fd, or smb2_close in the call stack.
• Process: Unexpected kernel worker crashes or restarts in the ksmbd-io workqueue; system instability or reboots coinciding with SMB activity.
• File System: No specific file artifacts expected, but post-exploitation activity may include new files or modified configurations if kernel-level code execution is achieved (GitHub Advisory).

Patches are available in the Linux kernel stable tree targeting the affected version ranges: fixes are present in commits 568a25fd, 9b0792c3, a5828c14, b0158d9d, and b425e4d0 on git.kernel.org. Users should update to patched kernel versions (≥6.6.130, ≥6.12.78, ≥6.18.20, or ≥6.19.10 as applicable) once available from their Linux distribution. As an interim workaround, restrict network access to SMB services (TCP port 445) to trusted hosts only, or disable ksmbd entirely if SMB file sharing is not required (GitHub Advisory, Feedly).

The vulnerability was tracked by the Yocto Project security mailing list, which issued multiple advisories in April–May 2026 regarding affected embedded Linux builds. Tenable published a Nessus plugin (ID 304983) to detect vulnerable systems. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability database entries (Feedly).