CVE-2026-72492 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems, particularly those responsible for managing and securing Linux kernel deployments, should review and apply patches. Additionally, affected operator, platform, vulnerability-management, and security-team impact should be assessed.

Technical summary

The same_client_has_lease function in the Linux kernel's ksmbd implementation returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. This can lead to a use-after-free when smb_grant_oplock dereferences the pointer in copy_lease and when checking breaking_cnt. To fix this, take a reference when same_client_has_lease selects an existing lease, drop any previous match while scanning, and release the returned reference in smb_grant_oplock after copying the lease state. Affected Linux kernel developers should review and apply patches.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Monitor for any potential exploitation attempts
• Consider implementing additional security controls to mitigate the risk of use-after-free vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved in the Linux kernel. The source item is from the NVD modified API. Multiple source references are provided, including several Git commit hashes. To verify, defenders should review the official advisory and assess their Linux kernel deployments for potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.