CVE-2026-23428: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23428 is a use-after-free (UAF) vulnerability in the Linux kernel's ksmbd subsystem affecting the handling of compound SMB2 requests. The flaw was published on April 3, 2026, and affects multiple Linux kernel stable branches: 5.15.121–5.15.203, 6.1.36–6.1.167, 6.3.10–6.4, 6.4.1–6.6.130, 6.7–6.12.78, 6.13–6.18.20, 6.19–6.19.10, and 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is a use-after-free condition (CWE-416) in smb2_get_ksmbd_tcon(), which reuses work->tcon in compound SMB2 requests without validating tcon->t_state. While ksmbd_tree_conn_lookup() enforces a t_state == TREE_CONNECTED check on the initial lookup path, the compound request reuse path bypasses this validation entirely. An attacker can craft a compound SMB2 request where an earlier command (e.g., SMB2_TREE_DISCONNECT) transitions t_state to TREE_DISCONNECTED and frees share_conf via ksmbd_share_config_put(); a subsequent command in the same compound (e.g., SMB2_WRITE) then dereferences the already-freed share_conf through work->tcon->share_conf. A KASAN report confirms the crash in smb2_write+0xc74/0xe70 with a slab-use-after-free read (GitHub Advisory).

Successful exploitation can result in kernel crashes (denial of service), information disclosure from freed kernel memory, or potentially arbitrary code execution in kernel context depending on heap state at the time of exploitation. Because the vulnerability resides in the kernel's SMB server subsystem, a compromised kernel could allow an attacker to escalate privileges or pivot to other resources accessible from the affected host. The KASAN report demonstrates a concrete crash in smb2_write() triggered by reading freed share_conf memory (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires low privileges (authenticated SMB2 access) and local/network access to a ksmbd server to send crafted compound requests. The EPSS score is approximately 0.024% (11th percentile), indicating a low near-term exploitation probability. CVE-2026-23428 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify Linux hosts running the ksmbd SMB2 server (kernel versions 5.15.121–5.15.203, 6.1.36–6.1.167, 6.4.1–6.6.130, 6.7–6.12.78, 6.13–6.18.20, or 6.19–6.19.10) by scanning for open TCP port 445 and confirming ksmbd is the serving process.
2. Authenticate: Obtain valid SMB2 credentials (low-privilege user account) to connect to the ksmbd server, as the vulnerability requires PR:L (low privileges).
3. Establish tree connection: Send an SMB2_TREE_CONNECT request to establish a valid tree connection (tcon) with t_state == TREE_CONNECTED, causing share_conf to be allocated via ksmbd_share_config_get().
4. Craft malicious compound request: Construct a compound SMB2 request that includes SMB2_TREE_DISCONNECT as an earlier command followed by SMB2_WRITE (or another command that dereferences share_conf) in the same compound batch.
5. Trigger use-after-free: Send the compound request. The SMB2_TREE_DISCONNECT command frees share_conf via ksmbd_share_config_put() and sets t_state = TREE_DISCONNECTED. The subsequent SMB2_WRITE command in the compound reuses work->tcon without re-validating t_state, dereferencing the freed share_conf.
6. Achieve objective: Depending on heap layout, the result is a kernel crash (DoS), kernel memory disclosure, or potential arbitrary kernel code execution (GitHub Advisory).

• Network: Unusual compound SMB2 requests on TCP port 445 containing both SMB2_TREE_DISCONNECT and SMB2_WRITE (or other commands) in a single compound batch from the same session; repeated SMB2 connection attempts from a single source.
• Logs: Kernel panic or KASAN slab-use-after-free messages in /var/log/kern.log or dmesg referencing smb2_write+0xc74/0xe70 or ksmbd-io handle_ksmbd_work; unexpected ksmbd worker crashes.
• Process: Unexpected termination or restart of ksmbd worker threads (kworker/N:N) visible in process listings or system logs.
• File System: Kernel crash dump files (e.g., /var/crash/) generated following exploitation attempts (GitHub Advisory).

Apply the upstream kernel patches available for all affected stable branches via the kernel stable tree (commits 7f7468fd, 806f1375, a5929c20, c33615f9, c742b46a, d0841798, eae0dc86). Fixed versions include 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10. As an interim workaround, disable ksmbd if SMB server functionality is not required, or restrict SMB2/CIFS access (TCP port 445) to trusted networks only using firewall rules (GitHub Advisory).