CVE Intelligence
Analysis AI-assisted

CVE-2026-53010: Linux kernel ksmbd use-after-free in smb2_open durable reconnect

CVE-2026-53010 is a use-after-free (CWE-416) in the ksmbd SMB server of the Linux kernel, triggered when a durable reconnect releases a file descriptor reference too early in smb2_open. The CNA assigned a CVSS 3.1 base score of 9.8 (critical), with a network attack vector and no privileges or user interaction required. The sources consulted show no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The ksmbd component is an in-kernel SMB server in the Linux kernel. According to the record, during durable reconnect processing in smb2_open, the reference to the durable file descriptor is dropped too early. A later error or a scavenger accessing the file can then touch memory that has already been released. The upstream fix moves the single release to the end of the function, below the err_out2 label, so the file structure stays valid until smb2_open returns.

Impact

  • The flaw is classified as Use After Free (CWE-416), which can cause memory corruption, kernel crashes or other unpredictable behavior.
  • The CNA vector indicates high confidentiality, integrity and availability impact, reachable over the network without privileges or user interaction.
  • The practical impact in a given deployment is unknown from the record.

Affected products and versions

  • Product listed: Linux Linux Kernel.
  • Affected ranges: from 6.6.32 up to, but not including, 6.7; from 6.9 up to, but not including, 6.18.33; from 6.19 up to, but not including, 7.0.10.
  • The record does not state which stable branch each patch commit targets, so the kernel stable references should be checked for branch-specific details.

Exploitation status

  • The record shows no CISA KEV listing for this CVE.
  • No confirmed active exploitation appears in the sources consulted.
  • No EPSS score is available in the record.

Remediation and mitigation

  • Update to a stable kernel release that includes the upstream patches referenced in the record, and confirm that the running version falls outside the affected ranges.
  • If ksmbd is not required, disable the service.
  • Restrict network access to SMB services to trusted segments until the update is applied.

Detection guidance

  • Inventory systems that run ksmbd and record their kernel versions.
  • Review kernel logs for memory errors or oops messages that reference ksmbd.
  • Watch for unexpected restarts of the SMB service or unusual behavior during durable reconnect activity.

Limitations of the available information

  • The record does not describe exploitation conditions beyond the summary, and no public proof of concept is referenced.
  • No vendor distribution advisories were included in the record.
  • The mapping between patch commits and specific kernel branches is not provided.
  • No EPSS data is available.

Sources: NVD entry and CVE.org record.

Frequently asked questions

Is CVE-2026-53010 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which Linux kernel versions are affected?

The record lists three ranges: from 6.6.32 before 6.7, from 6.9 before 6.18.33, and from 6.19 before 7.0.10.

What should administrators do first?

Apply a stable kernel update that includes the referenced upstream patches, verify the running version, and disable ksmbd if it is not needed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.