CVE-2026-23428 — Expired Pointer Dereference in Linux
Severity
—N/A
No vectorEPSS
0.0%
top 90.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 3
Latest updateApr 19
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of share_conf in compound request
smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without
validating tcon->t_state. ksmbd_tree_conn_lookup() checks t_state ==
TREE_CONNECTED on the initial lookup path, but the compound reuse path
bypasses this check entirely.
If a prior command in the compound (SMB2_TREE_DISCONNECT) sets t_state
to TREE_DISCONNECTED and frees share_conf via ksmbd_share_c…
Affected Packages3 packages
▶CVEListV5linux/linux854156d12caa9d36de1cf5f084591c7686cc8a9d — eae0dc86f71e6f3294c0cd7ffc05039258d243af+8
🔴Vulnerability Details
3VulDB▶
Linux Kernel up to 7.0-rc4 ksmbd smb2_get_ksmbd_tcon use after free (EUVD-2026-18661 / Nessus ID 304959)↗2026-04-19
GHSA▶
GHSA-v45r-hfjf-mq4q: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of share_conf in compound request
smb2_get_ksmbd_tcon(↗2026-04-03
OSV▶
CVE-2026-23428: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_get_ksmbd_tcon()↗2026-04-03