Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s ksmbd SMB file server can leave a file handle pointing to a freed network connection. Later file-close processing may access that freed memory, potentially crashing or corrupting the kernel. Risk is concentrated on systems running ksmbd and accepting SMB connections; systems not using ksmbd are unlikely to be exposed through this path.
Executive priority
Treat as urgent where ksmbd serves SMB to untrusted or broadly accessible networks because the flaw crosses the network-to-kernel boundary without stated privileges. Prioritize inventory and kernel updates immediately. Systems without ksmbd, or with SMB tightly isolated, have materially lower practical exposure but still require documented verification.
Technical view
During SMB durable-v2 replay, parse_durable_handle_context() can overwrite an active file handle’s fp->conn because ksmbd_lookup_fd_cguid() does not filter by connection. After the replacement connection is freed, __ksmbd_close_fd() locks through the stale pointer, producing a kernel use-after-free confirmed by KASAN. The supplied CVSS is 9.8, although demonstrated impact is the memory-safety violation rather than a documented exploit.
Likely exposure
Highest exposure is on affected Linux kernels where ksmbd is enabled and SMB is reachable by untrusted clients. Exposure depends on actual kernel build, backports, ksmbd usage, and network controls. The supplied affected-version data mixes release numbers and commit identifiers, so administrators should confirm status through their kernel distributor rather than relying solely on version-string comparisons.
Exploitation context
The trigger involves SMB2 durable-handle v2 replay against an already active file handle, followed by connection lifecycle and close processing. The record includes a KASAN crash trace. KEV is false, and the supplied sources provide no evidence of active exploitation, a public proof of concept, or reliable remote code execution.
Researcher notes
The root cause is connection ownership corruption during replay lookup, culminating in stale-pointer locking within __ksmbd_close_fd(). KASAN establishes reproducible use-after-free behavior. No CWE is assigned in the bundle. Exact branch boundaries and fix mapping require careful review of the referenced stable commits or distributor advisories; exploitation beyond denial of service is not demonstrated by the supplied evidence.
Mitigation direction
- Install a supported kernel update containing the vendor’s fix for CVE-2026-23427.
- Check distribution advisories for backport status before judging exposure by kernel version alone.
- Disable ksmbd if it is unnecessary for business operations.
- Restrict SMB access to trusted networks and clients until remediation is confirmed.
Validation and detection
- Confirm whether ksmbd is enabled, loaded, or configured to provide SMB shares.
- Identify running kernel builds and compare them with distributor guidance for CVE-2026-23427.
- Verify SMB reachability from untrusted networks and review firewall segmentation.
- Confirm the deployed kernel includes the applicable referenced stable-kernel fix.
- Monitor for kernel crashes or memory-safety reports involving ksmbd connection and close handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23427 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b0158d9d6f4ec5941e49a0b812735db2844f9975CVE reference, Linux
- https://git.kernel.org/stable/c/568a25fd7bcdfb2790f7d42aa2a440dca4435c96CVE reference, Linux
- https://git.kernel.org/stable/c/a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2CVE reference, Linux
- https://git.kernel.org/stable/c/9b0792c3eacf01e67f356d6ef9707b0ae5022419CVE reference, Linux
- https://git.kernel.org/stable/c/b425e4d0eb321a1116ddbf39636333181675d8f4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.