CVE-2026-23226High· 8.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between look…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
0.5% → 0.5%
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add chann_lock to protect ksmbd_chann_list xarray
ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del).
Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase accesses.
Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 43ad494ac6e940a8eabf25d5bd77bb3bb53b1153Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 4c2ca31608521895dd742a43beca4b4d29762345Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < e4a8a96a93d08570e0405cfd989a8a07e5b6ff33Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 36ef605c0395b94b826a8c8d6f2697071173de6eLinux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 4f3a06cc57976cafa8c6f716646be6c79a99e485Linux b1caecbf34b8c8260d851ec4efde71f3694460b7Linux 91bbf9cb2387a0d76322e9a343bc6bc160f66b3fLinux 853c416710b075153c1e1421e099ffbe5dac68ceLinux >= 5.15.145 < 5.16Linux >= 6.1.29 < 6.2Linux >= 6.2.16 < 6.3Linux 6.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets