CVE-2026-53046 ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
A use-after-free in the Linux kernel ksmbd module on Qualcomm hardware allows attackers to cause a system crash via async crypto operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53046?
CVE-2026-53046 is a critical use after free vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and immediately frees the request while the hardware DMA operation is still in flight. The DMA completion callback then dereferences freed memory, causing a NULL pointer crash:
pc : qce_skcipher_done+0x24/0x174 lr : vchan_complete+0x230/0x27c ... el1h_64_irq+0x68/0x6c ksmbd_free_work_struct+0x20/0x118 [ksmbd] ksmbd_exit_file_cache+0x694/0xa4c [ksmbd]
Use the standard crypto_wait_req() pattern with crypto_req_done() as the completion callback, matching the approach used by the SMB client in fs/smb/client/smb2ops.c. This properly handles both synchronous engines (immediate return) and async engines (-EINPROGRESS followed by callback notification).
Weakness: CWE-416
Which versions are affected by CVE-2026-53046?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53046?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-53046 being exploited?
There is no known exploitation of CVE-2026-53046 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53046, DEBIAN-CVE-2026-53046, GHSA-rchw-wq4w-xpmh, ROOT-OS-DEBIAN-12-CVE-2026-53046, ROOT-OS-UBUNTU-2204-CVE-2026-53046, ROOT-OS-UBUNTU-2404-CVE-2026-53046 and 1 more.