CVE-2026-80926
A critical use-after-free vulnerability (CVE-2026-80926) in the Linux kernel's ksmbd subsystem allows a race condition where a freed connection can be reused after being detached, potentially leading to arbitrary code execution. The bug occurs because ksmbd_oplock_break_notify() dereferences opiniono->conn without proper locking while other threads may have already freed it.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Any authenticated client holding a durable batch oplock can be exploited
Real-world impact
An attacker could trigger a break operation that resurrects a previously freed connection, causing undefined behavior or privilege escalation in the SMB share subsystem.
Why this severity
Critical (CVSS 9.8) due to remote code execution potential through a race condition involving concurrent detach and break notifications.
What to do about it
- 01Update the Linux kernel and ksmbd package to the patched version that resolves CVE-2026-80926
- 02Rebuild or reinstall the ksmbd component after applying the patch
- 03Verify the system is running the updated version that includes the fix
- ›If an immediate patch is not available, apply the in-place fixes described in the NVD advisory: ensure the caller's inode is threaded into the notification path and that connections are pinned under ci->m_lock before updating opiniono->conn to prevent use-after-free.
NVD-referenced vendor advisory (CVE-2026-80926 fix in Linux kernel)
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 4h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.