CVE-2026-53010: ksmbd: fix use-after-free in smb2_open during durable reconnect

Synopsis

A use-after-free vulnerability exists in the Linux kernel's ksmbd SMB server component, specifically in the smb2_open function during durable session reconnect handling. The flaw is reachable over the network without any authentication or user interaction, allowing a remote attacker to exploit freed memory. Successful exploitation gives an attacker full read access to kernel memory, the ability to tamper with kernel data structures, and the ability to crash or take control of the affected system. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The ksmbd SMB server listens on the network, so an attacker must be able to send SMB2 packets to the target host over the network to trigger the vulnerability.

• AuthenticationNot required

  No credentials are needed; the vulnerability can be triggered during the durable reconnect path before session authentication is enforced.

• Victim interactionNot required

  No user or administrator action is required; the attacker initiates the exploit entirely through crafted network packets.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker can read arbitrary kernel memory, exposing cryptographic keys, session tokens, and other sensitive data held in kernel address space.
• The attacker can overwrite kernel data structures, enabling privilege escalation or persistent tampering with kernel behavior.
• The attacker can crash the affected system outright, causing a denial of service for all workloads on the host.
• In the worst case the attacker achieves arbitrary kernel code execution, giving full control of the host and every container running on it.