CVE-2026-89635

A flaw was found in ksmbd, a component of the Linux kernel. An authenticated attacker could exploit a use-after-free vulnerability by manipulating durable handles and oplocks during session reconnection. When two sessions hold durable handles on the same file and both disconnect, reconnecting one of them can incorrectly adopt the other session's oplock. If the adopting session is then destroyed, the foreign oplock still points to the freed session, leading to a use-after-free when dereferenced. This can result in a system crash and a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.