Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger When a durable file handle survives session disconnect (TCP close without SMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the handle for later reconnection. However, it did not clean up the byte-range locks on fp->lock_list. Later, when the durable scavenger thread times out and calls __ksmbd_close_fd(NULL, fp), the lock cleanup loop did: spin_lock(&fp->conn->llist_lock); This caused a slab use-after-free because fp->conn was NULL and the original connection object had already been freed by ksmbd_tcp_disconnect(). The root cause is asymmetric cleanup: lock entries (smb_lock->clist) were left dangling on the freed conn->lock_list while fp->conn was nulled out. To fix this issue properly, we need to handle the lifetime of smb_lock->clist across three paths: - Safely skip clist deletion when list is empty and fp->conn is NULL. - Remove the lock from the old connection's lock_list in session_fd_check() - Re-add the lock to the new connection's lock_list in ksmbd_reopen_durable_fd().
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-05-01 | 1 | General1 |
| 2026-05-12 | 4 | Disclosure1General2Patch1 |
| 2026-05-23 | 1 | Disclosure1 |
Later, when the durable scavenger thread times out and calls ksmbdclosefd(NULL, fp), the lock cleanup loop did: CVE: CVE-2026-31718 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The content mentions CVE‑2026‑31718 with a CVSS 9.8 score and critical severity, but offers no proof‑of‑concept, exploit details, or patch information.
CVE: CVE-2026-31718 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbdclosefd() via durable scavenger When…
Post summary
CVE‑2026‑31718 is a critical Linux kernel use‑after‑free bug in ksmbd, now fixed by a patch; no PoC, exploit or active exploitation details are provided.
CRITICAL: CVE-2026-31718 (CVSS 9.8) — multiple products. CVE: CVE-2026-31718 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text announces CVE-2026-31718 as a critical issue with detailed CVSS information but provides no PoC, exploit, active usage, patch, or correction.
🚨 CRITICAL: CVE-2026-31718 (CVSS 9.8) Linux kernel ksmbd use-after-free flaw allows remote code execution via durable file handle scavenger. Affects network-attached storage implementations. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/P25G9ftF4y
Post summary
A critical use‑after‑free vulnerability in the Linux kernel (CVE‑2026‑31718) has been disclosed; it allows remote code execution on systems using ksmbd and a patch is urged immediately.
https://lyrie.ai/research/research/cve-2026-31718-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post shares a link to an advisory for CVE‑2026‑31718 but includes no additional details on the vulnerability, PoC, exploitation, or mitigation.
CVE-2026-31718 Use-After-Free in Linux Kernel ksmbd via Durable File Handle Scavenger https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31718
Post summary
CVE-2026-31718 is identified as a use‑after‑free flaw in the Linux kernel’s ksmbd module, yet no proof‑of‑concept, exploit code, or patch information is mentioned.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |