CVE-2026-52996: Linux Kernel ksmbd Durable Handle Reference Leak

Technical summary

CVE-2026-52996 is a reference-counting bug in ksmbd's durable handle v2 reconnect logic. The function ksmbd_lookup_fd_cguid() increments a reference count on a file descriptor when searching for a matching CreateGuid in the global file table. In the DURABLE_REQ_V2 code path, when the CreateGuid matches but the ClientGUID does not—a legitimate "Open not found" scenario per MS-SMB2 3.3.5.9.10—the code falls through to normal open handling without releasing the acquired reference. Repeated mismatches pin entries in the global file table, preventing the durable file scavenger from reclaiming them and causing resource exhaustion. The fix requires releasing the reference and clearing dh_info->fp in the mismatch path.

Business impact

Resource exhaustion on file servers running vulnerable kernel versions. Over time, repeated durable reconnect attempts with ClientGUID mismatches accumulate pinned file descriptors, consuming kernel memory and blocking the scavenger mechanism. On production SMB servers handling many client connections, this can lead to service degradation, file table saturation, or denial of service. Organizations relying on durable handle semantics for session recovery are at risk if clients are misconfigured or if workloads involve frequent reconnection attempts.

Affected systems

This vulnerability affects Linux kernel versions containing the vulnerable ksmbd code path. Ksmbd is the kernel SMB server component used by distributions that expose SMB/CIFS services directly from the kernel (common in NAS appliances, clustered storage, and containerized environments). Check your distribution's kernel version against available patches; the vulnerability impacts any kernel before the fix is applied. Affected systems are primarily those running kernel versions that include ksmbd with the unpatched durable handle v2 logic.

Exploitability

Exploitability requires network-level access to the SMB service and the ability to initiate durable handle v2 reconnections with a valid CreateGuid but mismatched ClientGUID. This is a local-adjacent attack (AV:L per CVSS) that does not require elevated privileges—a local or authenticated remote user can trigger the leak by repeatedly attempting reconnections. No user interaction is needed. The attack is reliable and repeatable, though the impact is cumulative rather than immediate, making it suitable for slow resource-exhaustion campaigns.

Remediation

Update to a patched Linux kernel version that includes the fix for CVE-2026-52996. The patch adds proper reference release and clears dh_info->fp in the ClientGUID mismatch path. Verify the specific kernel version from your vendor or the Linux kernel security advisories. As an interim mitigation, if feasible, restrict SMB access to trusted networks or rate-limit durable reconnection attempts to slow resource accumulation.

Patch guidance

Check your Linux distribution's security advisory and kernel update repository for a kernel version published on or after 2026-07-15 that resolves CVE-2026-52996. Apply the kernel update and reboot. Verify that ksmbd is enabled in your kernel configuration (CONFIG_SMB_SERVER); systems without ksmbd are unaffected. After patching, monitor file table and memory usage to confirm that durable handle processing no longer leaks references.

Detection guidance

Monitor kernel log messages and /proc/sys/fs/file-nr for signs of file descriptor exhaustion or warnings from the durable scavenger. Track SMB server reconnection failures that correspond to ClientGUID mismatches. Watch for increasing file table pressure (high "allocated" count in /proc/fs/nfs/nfsfs) if using ksmbd. Correlate SMB client reconnection attempts with resource pressure. Enable ksmbd debug logging if available in your distribution to capture durable handle mismatch events.

Why prioritize this

This is a medium-severity denial-of-service vector affecting kernel resource management. While not remotely exploitable from the network perimeter (AV:L), it can be triggered by any authenticated SMB client or local user with network access to the SMB service. The cumulative nature of the leak makes it suitable for sustained DoS attacks. Organizations running kernel-level SMB servers (ksmbd) should prioritize patching to prevent resource exhaustion, especially in multi-tenant or high-connection-count environments.

Risk score, explained

CVSS 5.5 (MEDIUM) reflects high availability impact (A:H) with low attack complexity and no special privileges required, offset by local attack vector and no direct confidentiality or integrity exposure. The severity is justified by the denial-of-service potential through resource exhaustion rather than data breach or privilege escalation risk. In high-traffic SMB environments, the practical impact may be higher due to accelerated resource depletion.

Frequently asked questions