Security readout for executives and security teams
Plain-English summary
This is a Linux kernel SMB server flaw in ksmbd. A logged-in network user could potentially trigger memory misuse during multi-channel SMB sessions, risking confidentiality, integrity, and availability. It matters most on Linux systems that expose ksmbd-based SMB file sharing.
Executive priority
Prioritize remediation where ksmbd provides file sharing across untrusted or large internal networks. The vulnerability is high severity and network reachable after authentication, but available evidence does not establish active exploitation.
Technical view
ksmbd_chann_list used an xarray without synchronization. The CVE describes a race between lookup_chann_list() and ksmbd_chann_del that can cause use-after-free in multi-channel sessions. The kernel fix adds chann_lock, an rw_semaphore in struct ksmbd_session, and protects xa_load, xa_store, and xa_erase access.
Likely exposure
Exposure is likely limited to Linux systems running the in-kernel ksmbd SMB server, especially where SMB is network reachable and multi-channel sessions are possible. The CVE lists affected Linux versions and specific kernel commit ranges, but distribution package impact must be confirmed through vendor advisories.
Exploitation context
The CVE has CVSS 8.8 with network attack vector, low complexity, low privileges required, and no user interaction. The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Treat exploitation status as unconfirmed.
Researcher notes
Focus validation on ksmbd multi-channel session handling and whether vendor kernels backported chann_lock protection around ksmbd_chann_list xarray operations. Evidence is limited to the CVE record and kernel stable commits; no exploit details or real-world exploitation are cited.
Mitigation direction
- Apply vendor kernel updates that include the referenced ksmbd stable fixes.
- Prioritize internet-facing or broadly reachable ksmbd SMB servers.
- Restrict ksmbd SMB access to trusted networks until updated.
- If ksmbd is not required, disable it according to vendor guidance.
- Track distribution advisories for exact fixed package versions.
Validation and detection
- Inventory Linux hosts running kernels in the affected version ranges.
- Identify systems using ksmbd rather than only user-space SMB services.
- Confirm installed kernels include the referenced stable commits or vendor backports.
- Review SMB exposure boundaries and authentication requirements.
- Retest after patching to confirm the fixed kernel is active.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23226 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4c2ca31608521895dd742a43beca4b4d29762345CVE reference, Linux
- https://git.kernel.org/stable/c/e4a8a96a93d08570e0405cfd989a8a07e5b6ff33CVE reference, Linux
- https://git.kernel.org/stable/c/36ef605c0395b94b826a8c8d6f2697071173de6eCVE reference, Linux
- https://git.kernel.org/stable/c/4f3a06cc57976cafa8c6f716646be6c79a99e485CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.