UBUNTU-CVE-2026-23428

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of shareconf in compound request smb2getksmbdtcon reuses work-tcon in compound requests without validating tcon-tstate. ksmbdtreeconnlookup checks tstate == TREECONNECTED on the initial lookup path, but...

CVE-2026-23428

CVE-2026-23428 affects the Linux kernel ksmbd component handling SMB2. The root cause is a use-after-free when reusing work->tcon in compound SMB2 requests: after a prior command (e.g., SMB2_TREE_DISCONNECT) sets t_state to TREE_DISCONNECTED and ksmbd_share_config_put() frees share_conf, subse...