CVE-2026-72422

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ksmbd component during concurrent SMB2 NEGOTIATE requests. The smb2 handle negotiate() function allocates the conn->preauth info variable, which is shared connection state. If deassemble neg contexts() fails, the system frees this variable and sets it to NULL. However, the response send path smb3 preauth hash rsp(), called from handle ksmbd work(), reads and dereferences conn->preauth info->Preauth HashValue via the ksmbd gen preauth integrity hash() function without acquiring the necessary conn lock mutex. This creates a race condition where one worker can free the memory while another is reading it, leading to a slab use-after-free read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.