{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-72381 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-72381 is a critical use after free vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72381 and fix it if it is affected.\n\nWhat it is: CVE-2026-72381 is a critical use after free vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72381 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72381/ (Markdown: https://insights.sbomify.com/CVE-2026-72381/index.md)","id":"CVE-2026-72381","markdown":"https://insights.sbomify.com/CVE-2026-72381/index.md","name":"CVE-2026-72381","record":{"aliases":["BELL-CVE-2026-72381","DEBIAN-CVE-2026-72381","GHSA-qx34-9c4p-jvq8","UBUNTU-CVE-2026-72381"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A race condition in the Linux kernel's ksmbd module allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of fp-\u003eowner.name in durable handle owner check\n\nTwo concurrent SMB2 durable reconnects (DH2C/DHnC) on the same\npersistent_id race the fp-\u003eowner.name compare-read in\nksmbd_vfs_compare_durable_owner() against the kfree() in\nksmbd_reopen_durable_fd()'s reopen-success path. fp-\u003eowner.name is a\nstandalone kstrdup() buffer whose lifetime is independent of the fp\nrefcount, and the two sites share no lock: the compare reads the buffer\nwhile the reopen frees it, so the strcmp() can dereference freed memory.\n\nCommit 7ce4fc40018d (\"ksmbd: fix durable reconnect double-bind race in\nksmbd_reopen_durable_fd\") made the fp-\u003econn claim atomic under\nglobal_ft.lock (closing the owner.name double-free and the ksmbd_file\nwrite-UAF), but the compare-read versus reopen-free pair was left\nunserialized.\n\n  BUG: KASAN: slab-use-after-free in strcmp+0x2c/0x80\n  Read of size 1 by task kworker\n    strcmp\n    ksmbd_vfs_compare_durable_owner\n    smb2_check_durable_oplock\n    smb2_open\n  Freed by task kworker:\n    kfree\n    ksmbd_reopen_durable_fd\n    smb2_open\n  Allocated by task kworker:\n    kstrdup\n    session_fd_check\n    smb2_session_logoff\n  The buggy address belongs to the cache kmalloc-8\n\nSerialize both sides of the race with fp-\u003ef_lock.  The global durable\nfile-table lock still protects the durable reconnect claim, but\nfp-\u003eowner.name is per-open state and does not need to block unrelated\ndurable table lookups or reconnects.  The teardown is left at its\nexisting location after the reopen-success point so that an __open_id()\nrollback still retains owner.name for a later legitimate reconnect to\nverify.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ksmbd: fix use-after-free of fp-\u003eowner.name in durable handle owner check","id":"CVE-2026-72381","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ksmbd: reject undersized DACLs before parsing ACEs","id":"CVE-2026-72382"},"packages":[],"prev":{"headline":"xen/pvcalls: bound backend response req_id before indexing rsp[]","id":"CVE-2026-72380"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A race condition in the Linux kernel's ksmbd module allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.","url":"https://insights.sbomify.com/CVE-2026-72381/"}