CVE-2026-74522

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the close file table ids() function within the ksmbd module. A ksmbd file object can persist after a logical close if another session maintains a temporary reference via ksmbd lookup fd inode(). The ksmbd close fd() function marks the file as closed and releases the idr-owned reference but fails to remove the pointer from the closing session's idr until the final reference is released. If a foreign holder executes the final ksmbd fd put(), the put fd final() function provides the foreign session's file table to ksmbd close fd(), causing the object to be freed without removal from the owner's idr. Consequently, the owner session may dereference a stale pointer during file-table teardown.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.