CVE-2026-74522
ksmbd: fix use-after-free in __close_file_table_ids()
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.
INFO
Published Date :
Aug. 15, 2026, 1:17 p.m.
Last Modified :
Aug. 15, 2026, 1:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74522
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Remove volatile ID from owner's idr.
- Clear volatile_id before dropping reference.
- Apply the provided patch to the Linux kernel.
- Update the Linux kernel to the fixed version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74522.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74522 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74522
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74522 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74522 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '9be4a66f019ea90bd9deca70511f4f9ffebf5c6f', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'cffbdc86393b0235383a20c8c59bc32f16036459', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'e7188199eff46a636f3436356f0aae039be6dd66', 'versionType': 'git'}, {'status': 'affected', 'version': 'df30cbfd3d8a70e61ce59f63ce5ed2261799ac10', 'versionType': 'git'}, {'status': 'affected', 'version': 'aaf1d5ebb358f546414965b39da90107a7ca7ce5', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.38', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.17.6', 'lessThan': '5.18', 'versionType': 'semver'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table. Added Reference https://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac Added Reference https://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd Added Reference https://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f Added Reference https://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459 Added Reference https://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66