CVE-2026-43376

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-43376
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free by using call_rcu() for oplock_info ksmbd currently frees oplock_info immediately using kfree(), even though it is accessed under RCU read-side critical sections in places like opinfo_get() and proc_show_files(). Since there is no RCU grace period delay between nullifying the pointer and freeing the memory, a reader can still access oplock_info structure after it has been freed. This can leads to a use-after-free especially in opinfo_get() where atomic_inc_not_zero() is called on already freed memory. Fix this by switching to deferred freeing using call_rcu().

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c Patch
https://git.kernel.org/stable/c/1d6abf145615dbfe267ce3b0a271f95e3780e18e Patch
https://git.kernel.org/stable/c/1dfd062caa165ec9d7ee0823087930f3ab8a6294 Patch
https://git.kernel.org/stable/c/302fef75512b2c8329a3f5efab1ae7ba2562387a Patch
https://git.kernel.org/stable/c/ce8507ee82c888126d8e7565e27c016308d24cde Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
History

15 May 2026, 15:15

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c - () https://git.kernel.org/stable/c/08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c - Patch
References () https://git.kernel.org/stable/c/1d6abf145615dbfe267ce3b0a271f95e3780e18e - () https://git.kernel.org/stable/c/1d6abf145615dbfe267ce3b0a271f95e3780e18e - Patch
References () https://git.kernel.org/stable/c/1dfd062caa165ec9d7ee0823087930f3ab8a6294 - () https://git.kernel.org/stable/c/1dfd062caa165ec9d7ee0823087930f3ab8a6294 - Patch
References () https://git.kernel.org/stable/c/302fef75512b2c8329a3f5efab1ae7ba2562387a - () https://git.kernel.org/stable/c/302fef75512b2c8329a3f5efab1ae7ba2562387a - Patch
References () https://git.kernel.org/stable/c/ce8507ee82c888126d8e7565e27c016308d24cde - () https://git.kernel.org/stable/c/ce8507ee82c888126d8e7565e27c016308d24cde - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE CWE-416

11 May 2026, 08:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

08 May 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-08 15:16

Updated : 2026-05-15 15:15

NVD link : CVE-2026-43376

Mitre link : CVE-2026-43376

CVE.ORG link : CVE-2026-43376

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free