CVE-2026-53046: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine

Synopsis

A use-after-free vulnerability exists in the Linux kernel's ksmbd SMB server module, specifically in how it handles asynchronous cryptographic operations on hardware engines such as the Qualcomm Crypto Engine. When the hardware returns an in-progress status code, ksmbd incorrectly treats it as an error and frees the request buffer while a DMA operation is still running; the hardware's completion callback then dereferences that freed memory, producing a NULL pointer crash. Exploitation is possible over the network without any authentication, and a successful attacker gains full read, write, and denial-of-service capability against the affected host. A patched-image rebuild at the fix versions (5.15.209 and the identified upstream commits) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the ksmbd SMB service over the network; no local access or special network position is required (AV:N).

• AuthenticationNot required

  No credentials or existing session are needed to trigger the vulnerability (PR:N).

• Victim interactionNot required

  The crash is triggered entirely by the attacker's network request; no action by a logged-in user or admin is required (UI:N).

• Attack complexityDetail

  Exploitation is reliable and imposes no special preconditions such as race-condition timing or specific memory layout requirements (AC:L).

Blast Radius

• A successful attacker causes a NULL pointer dereference that crashes the ksmbd process, taking down SMB file-sharing availability for all connected clients.
• Memory-safety violation via use-after-free gives an attacker a primitive that, with further chaining, allows reading arbitrary kernel memory including credentials, session tokens, and file data cached in kernel buffers.
• The same memory-corruption primitive enables writes to freed kernel structures, allowing an attacker to overwrite kernel data and escalate to full kernel-level code execution on the host.