{
  "cveId": "CVE-2026-72381",
  "url": "https://patchblox.com/security/cve/CVE-2026-72381",
  "summary": "CVE-2026-72381 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-72381, released August 15, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free of fp-\u003Eowner.name in d...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free of fp-\u003Eowner.name in durable handle owner check  Two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistent_id race the fp-\u003Eowner.name compare-read in ksmbd_vfs_compare_durable_owner() against the kfree() in ksmbd_reopen_durable_fd()\u0027s reopen-success path. fp-\u003Eowner.name is a standalone kstrdup() buffer whose lifetime is independent of the fp refcount, and the two sites share no lock: the compare reads the buffer while the reopen frees it, so the strcmp() can dereference freed memory.  Commit 7ce4fc40018d (\u0022ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd\u0022) made the fp-\u003Econn claim atomic under global_ft.lock (closing the owner.name double-free and the ksmbd_file write-UAF), but the compare-read versus reopen-free pair was left unserialized.    BUG: KASAN: slab-use-after-free in strcmp\u002B0x2c/0x80   Read of size 1 by task kworker     strcmp     ksmbd_vfs_compare_durable_owner     smb2_check_durable_oplock     smb2_open   Freed by task kworker:     kfree     ksmbd_reopen_durable_fd     smb2_open   Allocated by task kworker:     kstrdup     session_fd_check     smb2_session_logoff   The buggy address belongs to the cache kmalloc-8  Serialize both sides of the race with fp-\u003Ef_lock.  The global durable file-table lock still protects the durable reconnect claim, but fp-\u003Eowner.name is per-open state and does not need to block unrelated durable table lookups or reconnects.  The teardown is left at its existing location after the reopen-success point so that an __open_id() rollback still retains owner.name for a later legitimate reconnect to verify.",
  "published": "2026-08-15T06:22:11Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00652,
  "epssPercentile": 0.51554,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.100-1",
      "fix": "DEBIAN-CVE-2026-72381",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-72381",
      "released": "2026-08-15T22:38:55Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-72381",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-72381",
      "released": "2026-08-15T22:38:55Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}