CVE-2026-89635

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbd_reopen_durable_fd() walks the inode's m_op_list and rebinds every detached oplock to the reconnecting session: list_for_each_entry_rcu(op, &ci->m_op_list, op_entry, lockdep_is_held(&ci->m_lock)) { if (op->conn) continue; op->conn = ksmbd_conn_get(fp->conn); op->sess = work->sess; } The only key is op->conn == NULL, which every detached durable handle on that inode matches, not just the one owned by fp. When two sessions hold durable handles on the same file and both disconnect, reconnecting one of them adopts the other session's oplock: op->sess is overwritten with the reconnecting session without taking a reference on it, while op->conn pins the connection. The sibling teardown path, session_fd_check(), keys on the identity of the connection being torn down (op->conn == conn) rather than on shared state, and so does not have this problem. Once the adopting session is destroyed, ksmbd_session_destroy() frees it while the foreign oplock still points at it. The reader in ksmbd_close_fd_app_instance_id() validates only opinfo->conn, which is still live thanks to the reference taken above, and then dereferences the stale session: if (!opinfo->conn) { up_read(&fp->f_ci->m_lock); goto out; } ft = &opinfo->sess->file_table; write_lock(&ft->lock); BUG: KASAN: slab-use-after-free in _raw_write_lock+0x74/0xd0 Write of size 4 at addr ffff88810a970528 by task kworker/0:0/9 Workqueue: ksmbd-io handle_ksmbd_work Call Trace: _raw_write_lock+0x74/0xd0 ksmbd_close_fd_app_instance_id+0x183/0x410 smb2_open+0x1346/0x4430 handle_ksmbd_work+0x2bb/0x7b0 Reached from an authenticated session against a share with the default durable-handle and oplock configuration: two sessions open the same file with a durable-v2 handle and an RH lease under distinct AppInstanceIds, both log off, one reconnects with DH2C, and a later durable-v2 create carrying the other AppInstanceId walks into the freed session. Constrain the loop to the oplock owned by the file being reopened.

• https://git.kernel.org/stable/c/3f220a0a62e6b9b391c9d1f0e6580b05173cc7f7
• https://git.kernel.org/stable/c/74e3ef4630f004c0de40c0540648a5a4033c6c9d

Published

Sep 11, 2026

Last Modified

Sep 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8963Spoofing issue in the Web Speech component. This vulnerabili…7.5
• CVE-2026-89630In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-89631In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-89632In the Linux kernel, the following vulnerability has been re…8.2
• CVE-2026-89633In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89634In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-89636In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89637In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89638In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89639In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-8964Spoofing issue in the Popup Blocker component. This vulnerab…7.5
• CVE-2026-89640In the Linux kernel, the following vulnerability has been re…7.1