CVE-2026-68381 (GCVE-0-2026-68381)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-17 05:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: pin conn during async oplock break notification
smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn
pointer in an async ksmbd_work and then queue that work on ksmbd-io. The
work only increments conn->r_count, which prevents teardown from passing
the pending-request wait after the increment, but it does not pin the
struct ksmbd_conn object.
If connection teardown races with an oplock break notification, the last
conn reference can be dropped before the queued worker finishes. The
worker then uses the freed conn in ksmbd_conn_write() and
ksmbd_conn_r_count_dec().
Take a real conn reference when publishing the conn pointer to the async
work item, and drop it after the notification work has decremented
r_count. Apply the same lifetime rule to lease break notification, which
uses the same work->conn pattern.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 09aeab68033161cb54f194da93e51a11aee6144b Version: a4261bbc33fbf99b99c80aa3a2c5097611802980 Version: 3aa660c059240e0c795217182cf7df32909dd917 Version: 3aa660c059240e0c795217182cf7df32909dd917 Version: 3aa660c059240e0c795217182cf7df32909dd917 Version: f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa Version: 6.6.84 ≤ Version: 6.12.20 ≤ Version: 6.13.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/oplock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f72fc9659d7f585460d43c158055df5afdcffb6",
"status": "affected",
"version": "09aeab68033161cb54f194da93e51a11aee6144b",
"versionType": "git"
},
{
"lessThan": "793e1c7041b93af96ff87e678329bc16aee7ba88",
"status": "affected",
"version": "a4261bbc33fbf99b99c80aa3a2c5097611802980",
"versionType": "git"
},
{
"lessThan": "6ecb252efa0b413ac3d9979fb4eec247f8fc1258",
"status": "affected",
"version": "3aa660c059240e0c795217182cf7df32909dd917",
"versionType": "git"
},
{
"lessThan": "14062c74e5b25c27edcff7a2fe0dc701c930b372",
"status": "affected",
"version": "3aa660c059240e0c795217182cf7df32909dd917",
"versionType": "git"
},
{
"lessThan": "aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9",
"status": "affected",
"version": "3aa660c059240e0c795217182cf7df32909dd917",
"versionType": "git"
},
{
"status": "affected",
"version": "f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa",
"versionType": "git"
},
{
"lessThan": "6.6.148",
"status": "affected",
"version": "6.6.84",
"versionType": "semver"
},
{
"lessThan": "6.12.101",
"status": "affected",
"version": "6.12.20",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/oplock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.6.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.12.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: pin conn during async oplock break notification\n\nsmb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn\npointer in an async ksmbd_work and then queue that work on ksmbd-io. The\nwork only increments conn-\u003er_count, which prevents teardown from passing\nthe pending-request wait after the increment, but it does not pin the\nstruct ksmbd_conn object.\n\nIf connection teardown races with an oplock break notification, the last\nconn reference can be dropped before the queued worker finishes. The\nworker then uses the freed conn in ksmbd_conn_write() and\nksmbd_conn_r_count_dec().\n\nTake a real conn reference when publishing the conn pointer to the async\nwork item, and drop it after the notification work has decremented\nr_count. Apply the same lifetime rule to lease break notification, which\nuses the same work-\u003econn pattern."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445 (and SMB-Direct); the oplock/lease break notification path is driven entirely by remote SMB2 CREATE/close traffic and connection teardown, so a remote peer reaches the freed-conn use over the network.\nAC:L - The attacker controls both sides of the race: one connection holds a batch oplock/lease while a second connection opens the same file to force the async break, and the first connection is then abruptly dropped so teardown passes the r_count wait before the increment lands; this can be retried across arbitrarily many connections.\nPR:N - ksmbd share access is commonly exposed with guest/anonymous mapping, so an unauthenticated or trivially-credentialed remote client can open files and trigger oplock/lease breaks; consistent with prior ksmbd connection-lifetime UAF scoring, no meaningful privilege gate protects this path.\nUI:N - No victim action is needed; the attacker\u0027s own two SMB connections create the oplock break and the racing disconnect entirely on their own initiative.\nS:U - The freed object and the corrupted state are both kernel memory owned by the ksmbd server within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free of struct ksmbd_conn lets the attacker reclaim the slab object with attacker-shaped data and have the worker read conn-\u003etransport and response state from it, enabling disclosure of kernel memory and pointer values, potentially leaked back over the SMB connection.\nI:H - ksmbd_conn_write() dereferences conn-\u003etransport-\u003eops-\u003ewritev from the freed object and indirectly calls it, and ksmbd_conn_lock()/ksmbd_conn_r_count_dec() perform mutex and atomic/waitqueue writes into freed memory, giving heap-spray-based control-flow hijack and arbitrary-write potential.\nA:H - Even without successful exploitation, using a freed ksmbd_conn (mutex operations, transport pointer dereference, waitqueue wakeup) reliably causes memory corruption, oops, or kernel panic, taking down the whole system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:04:27.523Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f72fc9659d7f585460d43c158055df5afdcffb6"
},
{
"url": "https://git.kernel.org/stable/c/793e1c7041b93af96ff87e678329bc16aee7ba88"
},
{
"url": "https://git.kernel.org/stable/c/6ecb252efa0b413ac3d9979fb4eec247f8fc1258"
},
{
"url": "https://git.kernel.org/stable/c/14062c74e5b25c27edcff7a2fe0dc701c930b372"
},
{
"url": "https://git.kernel.org/stable/c/aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9"
}
],
"title": "ksmbd: pin conn during async oplock break notification",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68381",
"datePublished": "2026-08-10T12:03:59.849Z",
"dateReserved": "2026-07-30T09:28:09.387Z",
"dateUpdated": "2026-08-17T05:04:27.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…