8.8
HIGH
CVSS 3.1
CVE-2026-74522
ksmbd: fix use-after-free in __close_file_table_ids()
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.
Details
INFO
Published Date :
Aug. 15, 2026, 1:17 p.m.
Last Modified :
Aug. 19, 2026, 5:21 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
Fix use-after-free by managing file table references and clearing volatile IDs.
- Remove volatile ID from owner's idr.
- Clear volatile_id before dropping reference.
- Apply the provided patch to the Linux kernel.
- Update the Linux kernel to the fixed version.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74522.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74522 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74522
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74522 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74522 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 19, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/19bfd90d5aaf63217735d81964585c5306158e5f Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '9be4a66f019ea90bd9deca70511f4f9ffebf5c6f', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'cffbdc86393b0235383a20c8c59bc32f16036459', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'e7188199eff46a636f3436356f0aae039be6dd66', 'versionType': 'git'}, {'status': 'affected', 'version': 'df30cbfd3d8a70e61ce59f63ce5ed2261799ac10', 'versionType': 'git'}, {'status': 'affected', 'version': 'aaf1d5ebb358f546414965b39da90107a7ca7ce5', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.38', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.17.6', 'lessThan': '5.18', 'versionType': 'semver'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '19bfd90d5aaf63217735d81964585c5306158e5f', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '9be4a66f019ea90bd9deca70511f4f9ffebf5c6f', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'cffbdc86393b0235383a20c8c59bc32f16036459', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'e7188199eff46a636f3436356f0aae039be6dd66', 'versionType': 'git'}, {'status': 'affected', 'version': 'df30cbfd3d8a70e61ce59f63ce5ed2261799ac10', 'versionType': 'git'}, {'status': 'affected', 'version': 'aaf1d5ebb358f546414965b39da90107a7ca7ce5', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.38', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.17.6', 'lessThan': '5.18', 'versionType': 'semver'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '9be4a66f019ea90bd9deca70511f4f9ffebf5c6f', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'cffbdc86393b0235383a20c8c59bc32f16036459', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'e7188199eff46a636f3436356f0aae039be6dd66', 'versionType': 'git'}, {'status': 'affected', 'version': 'df30cbfd3d8a70e61ce59f63ce5ed2261799ac10', 'versionType': 'git'}, {'status': 'affected', 'version': 'aaf1d5ebb358f546414965b39da90107a7ca7ce5', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.38', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.17.6', 'lessThan': '5.18', 'versionType': 'semver'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '9be4a66f019ea90bd9deca70511f4f9ffebf5c6f', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'cffbdc86393b0235383a20c8c59bc32f16036459', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'e7188199eff46a636f3436356f0aae039be6dd66', 'versionType': 'git'}, {'status': 'affected', 'version': 'df30cbfd3d8a70e61ce59f63ce5ed2261799ac10', 'versionType': 'git'}, {'status': 'affected', 'version': 'aaf1d5ebb358f546414965b39da90107a7ca7ce5', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.38', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.17.6', 'lessThan': '5.18', 'versionType': 'semver'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': '9be4a66f019ea90bd9deca70511f4f9ffebf5c6f', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'cffbdc86393b0235383a20c8c59bc32f16036459', 'versionType': 'git'}, {'status': 'affected', 'version': '8510a043d334ecdf83d4604782f288db6bf21d60', 'lessThan': 'e7188199eff46a636f3436356f0aae039be6dd66', 'versionType': 'git'}, {'status': 'affected', 'version': 'df30cbfd3d8a70e61ce59f63ce5ed2261799ac10', 'versionType': 'git'}, {'status': 'affected', 'version': 'aaf1d5ebb358f546414965b39da90107a7ca7ce5', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.38', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.17.6', 'lessThan': '5.18', 'versionType': 'semver'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.151', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/vfs_cache.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table. Added Reference https://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac Added Reference https://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd Added Reference https://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f Added Reference https://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459 Added Reference https://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.