CVE-2026-43379 Git CVE debrief

Who should care

Linux administrators, security teams, and service owners running kernels with ksmbd enabled or exposing SMB services on affected systems should prioritize this CVE. Systems that rely on kernel-level SMB file sharing deserve immediate review and patching.

Technical summary

The CVE description states that opinfo, obtained via rcu_dereference(fp->f_opinfo), is referenced after rcu_read_unlock() in smb_lazy_parent_lease_break_close(). That creates a race where a concurrent writer can free the object before later dereferences such as opinfo->is_lease, resulting in a use-after-free. The official NVD record assigns a network-reachable, no-authentication critical score and includes multiple kernel.org stable references for the fix.

Defensive priority

Immediate. This is a critical kernel use-after-free with high confidentiality, integrity, and availability impact per NVD. Patch or backport the fix as soon as your platform vendor provides it, and reduce exposure of ksmbd where feasible until updates are applied.

Recommended defensive actions

• Apply the vendor or stable-kernel update that addresses CVE-2026-43379 as soon as possible.
• Verify whether ksmbd is enabled or used on your systems; if it is not required, disable or remove the service/module according to your platform guidance.
• Prioritize internet-exposed or production SMB endpoints for expedited maintenance.
• Review asset inventories and patch-management reports for kernels that may include ksmbd support.
• Monitor for kernel crashes, unexpected SMB service instability, or security advisories from your Linux distribution and hardware vendor.

Evidence notes

The evidence base is limited to the CVE record and official references. The CVE description explicitly says opinfo is accessed after rcu_read_unlock() in smb_lazy_parent_lease_break_close(), creating a race that can lead to use-after-free. The NVD record provides the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Official references include the CVE record, NVD detail page, and five kernel.org stable commit URLs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.