{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72492","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.936Z","datePublished":"2026-08-15T05:57:26.967Z","dateUpdated":"2026-08-17T05:44:53.329Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:44:53.329Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in same_client_has_lease()\n\nsame_client_has_lease() returns an opinfo pointer from ci->m_op_list\nafter dropping ci->m_lock without taking a reference.\n\nsmb_grant_oplock() then dereferences that pointer in copy_lease() and\nwhen checking breaking_cnt. A concurrent close can remove the old lease\nfrom ci->m_op_list and drop the last reference before the caller uses\nthe returned pointer, leading to a use-after-free.\n\nTake a reference when same_client_has_lease() selects an existing lease,\ndrop any previous match while scanning, and release the returned\nreference in smb_grant_oplock() after copying the lease state."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - ksmbd is the in-kernel SMB server on TCP/445; the UAF is reached when a remote client sends SMB2_CREATE with a lease context, handled via ksmbd_conn_handler_loop() through smb2_open() and smb_grant_oplock() into same_client_has_lease().\nAC:L - The attacker controls both sides of the race by holding a leased open on one SMB connection while concurrently issuing SMB2_CREATE (lease upgrade) and SMB2_CLOSE on another connection or channel; no victim-dependent timing or memory layout is required.\nPR:L - Exploitation requires a valid SMB2 session, tree connect, and share permission to open/close the target file with SMB3 leasing enabled; smb2_check_user_session() rejects SMB2_CREATE without SMB2_SESSION_VALID, so this is not reachable on pre-authentication negotiate/echo paths.\nUI:N - No victim interaction is required; the attacker drives all SMB2_CREATE and SMB2_CLOSE operations on their own client connection(s) to trigger the concurrent lease lookup and file close.\nS:U - Impact is kernel heap corruption and privilege escalation on the SMB server host within the ksmbd/kernel security authority; it does not cross a VM, container, or IOMMU boundary.\nC:H - Use-after-free of a freed oplock_info/lease object in copy_lease() reads attacker-influenced slab contents (level, lease state, keys, flags, epoch), enabling kernel memory disclosure and arbitrary-read primitive construction.\nI:H - The UAF dereferences freed oplock_info and embedded lease pointers during copy_lease() and breaking_cnt checks, enabling heap grooming and memory corruption exploitable for arbitrary write or control-flow hijack as root.\nA:H - Concurrent close can free the oplock_info before smb_grant_oplock() uses it, causing reliable kernel memory corruption, oops, or panic and repeatable remote denial of service against the server."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/oplock.c"],"versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"09634cd055d9bd8dd167995ea52bcd8028dd5dac","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"7c3264d273d524aa6adcce23c01087271f13586f","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"79c7c59bb519db6f5a2a151965e825ec725614cc","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"0ff82a9cf9312678d8bc4edeef0b6e82659ac12a","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"65b655f65c3ca1ab5d598d3832bb0ff531725858","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/oplock.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0"},{"url":"https://git.kernel.org/stable/c/09634cd055d9bd8dd167995ea52bcd8028dd5dac"},{"url":"https://git.kernel.org/stable/c/7c3264d273d524aa6adcce23c01087271f13586f"},{"url":"https://git.kernel.org/stable/c/79c7c59bb519db6f5a2a151965e825ec725614cc"},{"url":"https://git.kernel.org/stable/c/35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d"},{"url":"https://git.kernel.org/stable/c/0ff82a9cf9312678d8bc4edeef0b6e82659ac12a"},{"url":"https://git.kernel.org/stable/c/65b655f65c3ca1ab5d598d3832bb0ff531725858"}],"title":"ksmbd: fix use-after-free in same_client_has_lease()","x_generator":{"engine":"bippy-1.2.0"}}}}