CVE-2026-53198: Linux ksmbd Use-After-Free via SMB2_CANCEL DoS

Technical summary

CVE-2026-53198 is a use-after-free vulnerability in ksmbd's SMB2_LOCK and SMB2_CANCEL handling. When a byte-range lock request is deferred (blocked), it registers an async work queue entry with a cancel callback (smb2_remove_blocked_lock) that holds a pointer to a file_lock structure. If the lock request is cancelled, the file_lock is freed via locks_free_lock(), but the work queue entry is not properly unlinked from conn->async_requests and its cancel callback is not cleared. A subsequent SMB2_CANCEL message targeting the same AsyncId will then invoke the stale cancel callback against the freed memory. The fix prevents this by checking the work's state flag (KSMBD_WORK_CANCELLED) before invoking cancel callbacks, ensuring a callback fires at most once.

Business impact

This vulnerability can disrupt SMB-based file sharing and collaboration services. Authenticated attackers on the network can trigger kernel panics, resulting in unplanned downtime and service unavailability. While remote code execution is theoretically possible via heap corruption, practical exploitation would depend on precise memory layout and kernel protections in the target environment. Organizations relying on Samba or SMB services for file sharing, backup, or archival are at risk.

Affected systems

The Linux kernel is affected, specifically the ksmbd subsystem. This impacts systems running Linux kernels with ksmbd enabled that expose SMB services (including Samba deployments that use ksmbd). Kernels prior to the fix commit are vulnerable. Specific patched version numbers should be verified against kernel.org and vendor advisories, as the data provided does not include exact version boundaries.

Exploitability

Exploitation requires network access to an SMB service and valid authentication credentials. The attack is not complex—two precisely-timed SMB2_CANCEL messages are needed—making it achievable by attackers with legitimate SMB access. The condition window is tight but reproducible, as evidenced by KASAN-based testing. No public exploit code or active in-the-wild exploitation is currently documented.

Remediation

Apply a kernel patch that adds a state check to smb2_cancel(), preventing the cancellation callback from being invoked on work already marked KSMBD_WORK_CANCELLED. System administrators should update their Linux kernels and, if applicable, Samba/SMB services to versions incorporating the fix. Patched kernel versions should be identified from linux-kernel.org and your distribution's security advisories.

Patch guidance

Monitor your Linux kernel version and check kernel.org security advisories and your distribution's kernel package updates for patches addressing this CVE. If you maintain custom kernel builds, incorporate the fix that adds a state guard check in smb2_cancel(). For Samba users on ksmbd-enabled systems, ensure your kernel is up to date before updating Samba itself, as the fix is kernel-level. Testing in a non-production environment is recommended before kernel updates to rule out compatibility issues.

Detection guidance

Watch for kernel logs containing KASAN reports referencing slab-use-after-free in __locks_delete_block, locks_delete_block, or smb2_remove_blocked_lock. Monitor SMB service logs (via syslog or auditd) for unusual patterns of SMB2_CANCEL messages sent in rapid succession by authenticated users targeting lock operations. Kernel crash dumps with stack traces pointing to the ksmbd locking code are strong indicators of exploitation attempts.

Why prioritize this

This is a HIGH-severity vulnerability affecting a widely-used network service. The combination of authenticated-but-easy-to-exploit attack surface, potential for denial-of-service (and theoretical code execution via heap corruption), and the prevalence of SMB services in enterprise environments makes this a priority. Organizations with ksmbd-enabled SMB services should patch promptly. The fact that it requires authentication slightly reduces urgency compared to unauthenticated RCE, but DoS impact on critical file services justifies rapid remediation.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network-accessible attack vector, (2) Low complexity (two timed SMB messages), (3) Requires Low privilege (SMB authentication), (4) High impact on confidentiality, integrity, and availability via memory corruption and kernel panic. The lack of user interaction and lack of scope change keep it from CRITICAL. Real-world impact hinges on the prevalence of ksmbd vs. userspace Samba and the network position of attackers relative to SMB services.

Frequently asked questions