CVE-2024-26592
A critical vulnerability in the Linux kernel’s ksmbd service can cause a use‑after‑free error when handling new TCP connections. The flaw is triggered by a race condition between connection setup and teardown.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users that run the ksmbd SMB server component, regardless of distribution or version, until the kernel is updated to a release that contains the ksmbd UAF fix.
Real-world impact
An attacker could exploit the use‑after‑free to crash the kernel or potentially execute arbitrary code with kernel privileges, leading to full system compromise.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the ksmbd UAF fix.
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Feb 22, 2024 · Feb 22, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 8h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.