Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80926— ksmbd: fix use-after-free in oplock break notification

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.6.143版本至6.7之前版本、6.12.94版本至6.13之前版本、6.18.36版本至6.18.51之前版本和7.0.13版本至7.1版本存在安全漏洞，该漏洞源于ksmbd的smb2_oplock_break_noti()未加锁读取并解引用opinfo->conn，与持久句柄断开时的连接拆除竞争，可能导致已释放连接被复活并再次解引用，造成释放后重用，任何持有持久批量oplock的已认证客户端均可触发。

CVSS 9.8 · Critical EPSS 0.45% · P38

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 1ff58dcfcab434ebb51649da33774fbb8e1f7b67< 5de0527f782430b1109a447646e32033ad018a6a affected
e735dbd489e3ea02be78dba991056fe1138be51e< c8279ae8df68cce9cd3b785e85f7a86c80a46e78 affected
b003086d76968298f22e7cf62239833b5a3a06b1< 8cc98db4fc590e6c7d9db6529320982ee16c5d1d affected
b003086d76968298f22e7cf62239833b5a3a06b1< 0e753899627b5e28a9fea8bca98262a6f65a2452 affected
945a86b21b40fb17183f5b27461baa6f03e2467f affected
75e33deda658c1ab3a9336cbdb1436536f9b3660 affected
6.12.94< 6.12.111 affected
6.18.36< 6.18.51 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80926

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ksmbd: fix use-after-free in oplock break notification
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opinfo->conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo->conn and drops its conn reference under ci->m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock. Thread the caller's inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target's oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo->o_fp, which a concurrent close may free. Select and pin the connection under ci->m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo->conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to the work item and release it on allocation failures.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.6.143版本至6.7之前版本、6.12.94版本至6.13之前版本、6.18.36版本至6.18.51之前版本和7.0.13版本至7.1版本存在安全漏洞，该漏洞源于ksmbd的smb2_oplock_break_noti()未加锁读取并解引用opinfo->conn，与持久句柄断开时的连接拆除竞争，可能导致已释放连接被复活并再次解引用，造成释放后重用，任何持有持久批量oplock的已认证客户端均可触发。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1ff58dcfcab434ebb51649da33774fbb8e1f7b67 ~ 5de0527f782430b1109a447646e32033ad018a6a -
Linux Linux 7.1 -

II. Public POCs for CVE-2026-80926

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80926

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80926 (3)

Other References for CVE-2026-80926 (1)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89652 9.8 CRITICAL ceph: bound copied dentry name length in NFS export get_name
CVE-2026-89541 9.8 CRITICAL SUNRPC: harden gss_unwrap_resp_priv length checks
CVE-2026-89542 9.8 CRITICAL SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
CVE-2026-89546 9.8 CRITICAL SUNRPC: close backchannel before destroying callback service
CVE-2026-89550 9.8 CRITICAL SUNRPC: svcauth_gss: enforce krb5 token minimum length
CVE-2026-89555 9.8 CRITICAL mpls: reload header after pskb_may_pull()
CVE-2026-89558 9.8 CRITICAL md/raid10: fix still_degraded being inverted in raid10_sync_request()
CVE-2026-89658 9.8 CRITICAL NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
CVE-2026-89655 9.8 CRITICAL ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89656 9.8 CRITICAL libceph: reject buckets with mismatched CRUSH ids
CVE-2026-80986 9.8 CRITICAL net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
CVE-2026-89654 9.8 CRITICAL ceph: fix UAF in check_new_map() on session freed during unlock
CVE-2026-89653 9.8 CRITICAL ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
CVE-2026-80981 9.8 CRITICAL net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
CVE-2026-80980 9.8 CRITICAL net/smc: stop killed, freed and out_of_sync sharing a byte
CVE-2026-89651 9.8 CRITICAL ceph: bound MDSCapAuth path and fs_name decode in handle_session()
CVE-2026-89708 9.8 CRITICAL nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
CVE-2026-89636 9.8 CRITICAL smb: client: clear ce->tgthint in free_tgts()
CVE-2026-89635 9.8 CRITICAL ksmbd: only rebind the reopened file's own oplock on durable reconnect
CVE-2026-89633 9.8 CRITICAL smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80926

No comments yet

Leave a comment