CVE-2026-53198

kernel: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL

Loading…

Severity

Important

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · June 25, 2026

Updated · October 20, 2026

Description

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB server. An authenticated SMB client can trigger a use-after-free vulnerability by sending a double SMB2_CANCEL request for the same asynchronous operation. This can lead to memory corruption, potentially allowing an attacker to cause a denial of service or execute arbitrary code.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-1341 · Multiple Releases of Same Resource or Handle