{"id":"CVE-2026-23226","title":"ksmbd: add chann_lock to protect ksmbd_chann_list xarray","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add chann_lock to protect ksmbd_chann_list xarray\n\nksmbd_chann_list xarray lacks synchronization, allowing use-after-free in\nmulti-channel sessions (between look…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 43ad494ac6e940a8eabf25d5bd77bb3bb53b1153","Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 4c2ca31608521895dd742a43beca4b4d29762345","Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < e4a8a96a93d08570e0405cfd989a8a07e5b6ff33","Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 36ef605c0395b94b826a8c8d6f2697071173de6e","Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 4f3a06cc57976cafa8c6f716646be6c79a99e485","Linux b1caecbf34b8c8260d851ec4efde71f3694460b7","Linux 91bbf9cb2387a0d76322e9a343bc6bc160f66b3f","Linux 853c416710b075153c1e1421e099ffbe5dac68ce","Linux >= 5.15.145 < 5.16","Linux >= 6.1.29 < 6.2","Linux >= 6.2.16 < 6.3","Linux 6.3"],"published":"2026-02-18","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:39:01.586Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23226","references":[{"url":"https://git.kernel.org/stable/c/43ad494ac6e940a8eabf25d5bd77bb3bb53b1153"},{"url":"https://git.kernel.org/stable/c/4c2ca31608521895dd742a43beca4b4d29762345"},{"url":"https://git.kernel.org/stable/c/e4a8a96a93d08570e0405cfd989a8a07e5b6ff33"},{"url":"https://git.kernel.org/stable/c/36ef605c0395b94b826a8c8d6f2697071173de6e"},{"url":"https://git.kernel.org/stable/c/4f3a06cc57976cafa8c6f716646be6c79a99e485"}],"tags":["cve.org"],"epss":0.00479,"epssPercentile":0.41138,"ingestedAt":"2026-10-21T12:48:53.676Z","slug":"CVE-2026-23226","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add chann_lock to protect ksmbd_chann_list xarray\n\nksmbd_chann_list xarray lacks synchronization, allowing use-after-free in\nmulti-channel sessions (between lookup_chann_list() and ksmbd_chann_del).\n\nAdds rw_semaphore chann_lock to struct ksmbd_session and protects\nall xa_load/xa_store/xa_erase accesses.\n\n## Affected\n\n- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 43ad494ac6e940a8eabf25d5bd77bb3bb53b1153`\n- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 4c2ca31608521895dd742a43beca4b4d29762345`\n- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < e4a8a96a93d08570e0405cfd989a8a07e5b6ff33`\n- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 36ef605c0395b94b826a8c8d6f2697071173de6e`\n- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 4f3a06cc57976cafa8c6f716646be6c79a99e485`\n- `Linux b1caecbf34b8c8260d851ec4efde71f3694460b7`\n- `Linux 91bbf9cb2387a0d76322e9a343bc6bc160f66b3f`\n- `Linux 853c416710b075153c1e1421e099ffbe5dac68ce`\n- `Linux >= 5.15.145 < 5.16`\n- `Linux >= 6.1.29 < 6.2`\n- `Linux >= 6.2.16 < 6.3`\n- `Linux 6.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}