CVE-2026-72422 Linux CVE debrief

Who should care

Linux kernel users, administrators, and developers who use or manage systems with the ksmbd module enabled should be aware of this vulnerability and take steps to mitigate it. This includes verifying system configurations, ensuring ksmbd is properly configured, and monitoring for suspicious network activity related to SMB2 NEGOTIATE requests. Additionally, users should apply the latest Linux kernel updates to address the CVE-2026-72422 vulnerability and consider implementing compensating controls, such as monitoring for suspicious network activity, verifying system configurations, and ensuring ksmbd is properly configured. Users should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Furthermore, users should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Finally, users should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This should be done by reviewing compensating controls for exposed systems while remediation is scheduled and verified. Users should also consider the operational impact of this vulnerability and review the context of this vulnerability to understand its potential effects on their systems and networks. Users should also verify their systems are running with the latest updates and consider implementing compensating controls, such as monitoring for suspicious network activity. The vulnerability can be mitigated by applying the latest Linux kernel updates, monitoring for suspicious network activity, verifying system configurations, and ensuring ksmbd is properly configured. Users should also be aware of the potential operational impact of this vulnerability and review the context of this vulnerability to understand its potential effects on their systems and networks. The CVE-2026-72422 vulnerability can be addressed by taking these steps to mitigate its effects and ensure

Technical summary

The CVE-2026-72422 vulnerability is a use-after-free issue in the Linux kernel's ksmbd module, specifically in the SMB2 NEGOTIATE handler. This occurs when a client drives two SMB2 NEGOTIATE requests on the same connection, allowing a concurrent send-path worker to read freed memory, producing a slab use-after-free read. The vulnerability has been resolved in the Linux kernel, and users are advised to apply the latest updates to address this issue. The fix involves serializing the NEGOTIATE-branch read in smb3_preauth_hash_rsp() under ksmbd_conn_lock(conn) and re-checking conn->preauth_info inside the lock.

Defensive priority

Linux kernel users should verify their systems are running with the latest updates and consider implementing compensating controls, such as monitoring for suspicious network activity.

Recommended defensive actions

• Apply the latest Linux kernel updates to address the CVE-2026-72422 vulnerability
• Monitor for suspicious network activity related to SMB2 NEGOTIATE requests
• Verify system configurations and ensure ksmbd is properly configured
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-72422 vulnerability is a use-after-free issue in the Linux kernel's ksmbd module, specifically in the SMB2 NEGOTIATE handler. Evidence is based on official CVE and NVD records, as well as source references from the Linux kernel repository.

Official resources