CVE-2026-23226: linux Use After Free
CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2026-23226DEBIAN-CVE-2026-23226CGA-279h-ww67-4chrCGA-2j8m-5wr6-3hrfCGA-4452-m3q5-q24pCGA-4mjr-9m26-gjfwCGA-56j2-v2w4-35h5CGA-5j2c-m89c-xphfCGA-6m7f-jx32-pg66CGA-6w9r-vv99-9vxvCGA-7q6j-x6cj-8rghCGA-88m3-9839-pc79CGA-8pr5-83jf-mff3CGA-936c-cg38-p888CGA-9r99-cpm6-wmr7CGA-c63f-c83h-qwr8CGA-f5pf-gc9x-95p5CGA-g522-mwrr-xw26CGA-g8cm-4653-fq4hCGA-gc6p-7pjj-w35vCGA-gvx5-65mr-g7xjCGA-gwjh-qr42-wwq5CGA-h238-p92q-7ph2CGA-h2vr-7h2w-r95mCGA-h4gg-hrxj-gg98CGA-hc84-q7hc-vjw6CGA-hc97-xfvc-p569CGA-hxw6-55rw-68w9CGA-jj3x-6chc-7cqpCGA-mmpp-2pf3-762hCGA-p7r4-qr7h-xmq3CGA-pm9j-8p97-5w6qCGA-pmjm-pjvj-gc4wCGA-qf24-gqxr-c2f9CGA-qj68-g3px-h2v6CGA-qr4q-p75h-c74vCGA-rcgj-j7fq-qq8jCGA-rh4g-c8v6-5r6wCGA-rhq3-v2hm-c54qCGA-rw2m-j534-x5w4CGA-x2cr-5x6p-j32mCGA-xg2x-pjq5-vhpg
Published 18-02-2026Last modified 05-08-2026
Vulnerability summary
CVE-2026-23226 is a high (CVSS 8.8) Use After Free vulnerability in linux. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.2% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
0.46%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 15 · Related 16Timeline
- 18-02-2026PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del). Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase accesses.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.7Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesSingle source
High 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources5 sources · 7.8–8.8
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
+0.02 pp
From 0.44% on 19-09-2026
19-09-202619-10-2026
EPSS score0.46%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu145 products
- linuxAll versions (No fix recorded) | < 6.8.0-136.136
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 6.8.0-1061.64
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard5 products
- linux-aws-6.12< 6.12.77-r1 | < 6.12.74-r1 | < 6.12.80-r0 | < 6.12.77-r2 | < 6.12.78-r0 | < 6.12.77-r0 | < 6.12.76-r0
- linux-azure-6.12< 6.12.77-r1 | < 6.12.74-r1 | < 6.12.78-r0 | < 6.12.80-r0 | < 6.12.77-r2 | < 6.12.77-r0 | < 6.12.76-r0
- linux-gcp-6.12< 6.12.77-r0 | < 6.12.80-r0 | < 6.12.77-r2 | < 6.12.77-r1 | < 6.12.76-r0 | < 6.12.74-r1 | < 6.12.78-r0
- linux-qemu-6.12< 6.12.77-r2 | < 6.12.77-r1 | < 6.12.80-r0 | < 6.12.78-r0 | < 6.12.76-r0 | < 6.12.74-r1 | < 6.12.77-r0
- linux-vmware-6.12< 6.12.74-r1 | < 6.12.77-r1 | < 6.12.80-r0 | < 6.12.77-r0 | < 6.12.78-r0 | < 6.12.76-r0 | < 6.12.77-r2
Linux2 products
- linux≥ 1d9c4172110e645b383ff13eee759728d74f1a5d, < 4c2ca31608521895dd742a43beca4b4d29762345 | ≥ 1d9c4172110e645b383ff13eee759728d74f1a5d, < e4a8a96a93d08570e0405cfd989a8a07e5b6ff33 | ≥ 1d9c4172110e645b383ff13eee759728d74f1a5d, < 36ef605c0395b94b826a8c8d6f2697071173de6e | ≥ 1d9c4172110e645b383ff13eee759728d74f1a5d, < 4f3a06cc57976cafa8c6f716646be6c79a99e485 | b1caecbf34b8c8260d851ec4efde71f3694460b7 | 91bbf9cb2387a0d76322e9a343bc6bc160f66b3f | 853c416710b075153c1e1421e099ffbe5dac68ce | ≥ 5.15.145, < 5.16 | ≥ 6.1.29, < 6.2 | ≥ 6.2.16, < 6.3 | 6.3
- linux_kernel≥ 6.3, < 6.18.11 | ≥ 6.19, < 6.19.1
Debian1 product
- linuxAll versions (No fix recorded) | < 6.12.85-1 | < 6.18.12-1
4 vendors · 153 products
