CVE-2026-53046: Linux kernel ksmbd use-after-free in async crypto handling
The ksmbd SMB server component of the Linux kernel can free an AEAD crypto request while an asynchronous hardware engine such as the Qualcomm Crypto Engine still uses it, causing a use-after-free (CWE-416). The record gives a CVSS 3.1 base score of 9.8 from the CNA, and several stable kernel fix commits are referenced. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
The record describes a use-after-free in the ksmbd kernel SMB server. It occurs when an asynchronous crypto engine returns -EINPROGRESS and the calling code frees the request before the hardware operation completes. The weakness is classified as CWE-416 (Use After Free).
Impact
- The record describes a NULL pointer crash when the DMA completion callback runs against freed memory.
- The CNA assigns a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector indicates network reachability, low complexity, no privileges, no user interaction, and high impact on confidentiality, integrity and availability.
- Whether the crash can be used for more than denial of service is not stated in the record.
Affected products and versions
The record lists Linux Linux Kernel with these ranges:
- ≥ 5.15 and < 5.15.209
- ≥ 5.16 and < 6.1.175
- ≥ 6.2 and < 6.6.141
- ≥ 6.7 and < 6.12.91
- ≥ 6.13 and < 6.18.33
- ≥ 6.19 and < 7.0.10
The record does not list separate ksmbd module versions. Administrators should check whether their kernel builds include ksmbd and whether it is loaded.
Exploitation status
The record marks this CVE as not listed in CISA KEV, and no KEV dates or ransomware data are given. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Update to a stable kernel release from your distributor or from the upstream stable branch that includes the fix for your version line. The record links several stable commits, such as stable commit 3e29889 and stable commit 8fcefe8.
- The record does not describe a workaround. If patching is delayed, reducing network exposure of SMB services is a general hardening step, not a documented fix.
- Confirm after patching that the running kernel version falls within a fixed range listed above.
Detection guidance
- Inventory systems that run Linux kernels with ksmbd enabled and identify those with Qualcomm crypto hardware.
- Review kernel logs for unexpected crashes or oops reports that mention ksmbd or the crypto completion path named in the record.
- Monitor SMB service availability, since a crash would appear as service interruption or kernel restart.
Limitations of the available information
- The record provides no EPSS score, no SSVC data, and no CVSS score from providers other than the CNA.
- It does not state whether exploitation is feasible beyond the described crash.
- The record does not say which distributions have backported the fix, so administrators should check their vendor advisories.
Frequently asked questions
What is the vulnerability in CVE-2026-53046?
It is a use-after-free in the Linux kernel ksmbd component. An asynchronous crypto engine returns -EINPROGRESS, and the request is freed before the hardware finishes, which can crash the kernel.
Is this CVE known to be exploited?
The record says the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
How can I fix it?
Update to a stable kernel release that includes the fix for your version line, as provided by your distributor or the upstream stable branch. The record does not describe a workaround.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.