Answer in brief
CVE-2026-74522 records a Unknown severity vulnerability in ksmbd: fix use-after-free in __close_file_table_ids(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8510a043d334ecdf83d4604782f288db6bf21d60 <67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd || >=8510a043d334ecdf83d4604782f288db6bf21d60 <0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac || >=8510a043d334ecdf83d4604782f288db6bf21d60 <9be4a66f019ea90bd9deca70511f4f9ffebf5c6f || >=8510a043d334ecdf83d4604782f288db6bf21d60 <cffbdc86393b0235383a20c8c59bc32f16036459 || >=8510a043d334ecdf83d4604782f288db6bf21d60 <e7188199eff46a636f3436356f0aae039be6dd66 || df30cbfd3d8a70e61ce59f63ce5ed2261799ac10 || aaf1d5ebb358f546414965b39da90107a7ca7ce5 || >=5.15.38 <5.16 || >=5.17.6 <5.18 | 67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd, 0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac, 9be4a66f019ea90bd9deca70511f4f9ffebf5c6f, cffbdc86393b0235383a20c8c59bc32f16036459, e7188199eff46a636f3436356f0aae039be6dd66, 5.16, 5.18 |
| Linux/Linuxgeneric | 5.18 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-74522 records a Unknown severity vulnerability in ksmbd: fix use-after-free in __close_file_table_ids(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8510a043d334ecdf83d4604782f288db6bf21d60 <67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd || >=8510a043d334ecdf83d4604782f288db6bf21d60 <0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac || >=8510a043d334ecdf83d4604782f288db6bf21d60 <9be4a66f019ea90bd9deca70511f4f9ffebf5c6f || >=8510a043d334ecdf83d4604782f288db6bf21d60 <cffbdc86393b0235383a20c8c59bc32f16036459 || >=8510a043d334ecdf83d4604782f288db6bf21d60 <e7188199eff46a636f3436356f0aae039be6dd66 || df30cbfd3d8a70e61ce59f63ce5ed2261799ac10 || aaf1d5ebb358f546414965b39da90107a7ca7ce5 || >=5.15.38 <5.16 || >=5.17.6 <5.18 | 67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd, 0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac, 9be4a66f019ea90bd9deca70511f4f9ffebf5c6f, cffbdc86393b0235383a20c8c59bc32f16036459, e7188199eff46a636f3436356f0aae039be6dd66, 5.16, 5.18 |
| Linux/Linuxgeneric | 5.18 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.
Quoted source text, attributed separately from HOL analysis.