[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-23427":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T03:17:55.401Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":20,"aliases":21,"duplicate_of":9,"upstream":22,"downstream":23,"duplicates":30,"related":31,"reserved_at":9,"published_at":32,"modified_at":33,"state":34,"summary":35,"references_raw":44,"kevs":67,"epss":68,"epss_history":71,"metrics":347,"affected":358},"CVE-2026-23427","In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in durable v2 replay of active file handles\n\nparse_durable_handle_context() unconditionally assigns dh_info->fp->conn\nto the current connection when handling a DURABLE_REQ_V2 context with\nSMB2_FLAGS_REPLAY_OPERATION. ksmbd_lookup_fd_cguid() does not filter by\nfp->conn, so it returns file handles that are already actively connected.\nThe unconditional overwrite replaces fp->conn, and when the overwriting\nconnection is subsequently freed, __ksmbd_close_fd() dereferences the\nstale fp->conn via spin_lock(&fp->conn->llist_lock), causing a\nuse-after-free.\n\nKASAN report:\n\n[    7.349357] ==================================================================\n[    7.349607] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x75/0xe0\n[    7.349811] Write of size 4 at addr ffff8881056ac18c by task kworker/1:2/108\n[    7.350010]\n[    7.350064] CPU: 1 UID: 0 PID: 108 Comm: kworker/1:2 Not tainted 7.0.0-rc3+ #58 PREEMPTLAZY\n[    7.350068] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[    7.350070] Workqueue: ksmbd-io handle_ksmbd_work\n[    7.350083] Call Trace:\n[    7.350087]  \u003CTASK>\n[    7.350087]  dump_stack_lvl+0x64/0x80\n[    7.350094]  print_report+0xce/0x660\n[    7.350100]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[    7.350101]  ? __pfx___mod_timer+0x10/0x10\n[    7.350106]  ? _raw_spin_lock+0x75/0xe0\n[    7.350108]  kasan_report+0xce/0x100\n[    7.350109]  ? _raw_spin_lock+0x75/0xe0\n[    7.350114]  kasan_check_range+0x105/0x1b0\n[    7.350116]  _raw_spin_lock+0x75/0xe0\n[    7.350118]  ? __pfx__raw_spin_lock+0x10/0x10\n[    7.350119]  ? __call_rcu_common.constprop.0+0x25e/0x780\n[    7.350125]  ? close_id_del_oplock+0x2cc/0x4e0\n[    7.350128]  __ksmbd_close_fd+0x27f/0xaf0\n[    7.350131]  ksmbd_close_fd+0x135/0x1b0\n[    7.350133]  smb2_close+0xb19/0x15b0\n[    7.350142]  ? __pfx_smb2_close+0x10/0x10\n[    7.350143]  ? xas_load+0x18/0x270\n[    7.350146]  ? _raw_spin_lock+0x84/0xe0\n[    7.350148]  ? __pfx__raw_spin_lock+0x10/0x10\n[    7.350150]  ? _raw_spin_unlock+0xe/0x30\n[    7.350151]  ? ksmbd_smb2_check_message+0xeb2/0x24c0\n[    7.350153]  ? ksmbd_tree_conn_lookup+0xcd/0xf0\n[    7.350154]  handle_ksmbd_work+0x40f/0x1080\n[    7.350156]  process_one_work+0x5fa/0xef0\n[    7.350162]  ? assign_work+0x122/0x3e0\n[    7.350163]  worker_thread+0x54b/0xf70\n[    7.350165]  ? __pfx_worker_thread+0x10/0x10\n[    7.350166]  kthread+0x346/0x470\n[    7.350170]  ? recalc_sigpending+0x19b/0x230\n[    7.350176]  ? __pfx_kthread+0x10/0x10\n[    7.350178]  ret_from_fork+0x4fb/0x6c0\n[    7.350183]  ? __pfx_ret_from_fork+0x10/0x10\n[    7.350185]  ? __switch_to+0x36c/0xbe0\n[    7.350188]  ? __pfx_kthread+0x10/0x10\n[    7.350190]  ret_from_fork_asm+0x1a/0x30\n[    7.350197]  \u003C/TASK>\n[    7.350197]\n[    7.355160] Allocated by task 123:\n[    7.355261]  kasan_save_stack+0x33/0x60\n[    7.355373]  kasan_save_track+0x14/0x30\n[    7.355484]  __kasan_kmalloc+0x8f/0xa0\n[    7.355593]  ksmbd_conn_alloc+0x44/0x6d0\n[    7.355711]  ksmbd_kthread_fn+0x243/0xd70\n[    7.355839]  kthread+0x346/0x470\n[    7.355942]  ret_from_fork+0x4fb/0x6c0\n[    7.356051]  ret_from_fork_asm+0x1a/0x30\n[    7.356164]\n[    7.356214] Freed by task 134:\n[    7.356305]  kasan_save_stack+0x33/0x60\n[    7.356416]  kasan_save_track+0x14/0x30\n[    7.356527]  kasan_save_free_info+0x3b/0x60\n[    7.356646]  __kasan_slab_free+0x43/0x70\n[    7.356761]  kfree+0x1ca/0x430\n[    7.356862]  ksmbd_tcp_disconnect+0x59/0xe0\n[    7.356993]  ksmbd_conn_handler_loop+0x77e/0xd40\n[    7.357138]  kthread+0x346/0x470\n[    7.357240]  ret_from_fork+0x4fb/0x6c0\n[    7.357350]  ret_from_fork_asm+0x1a/0x30\n[    7.357463]\n[    7.357513] The buggy address belongs to the object at ffff8881056ac000\n[    7.357513]  which belongs to the cache kmalloc-1k of size 1024\n[    7.357857] The buggy address is located 396 bytes inside of\n[    7.357857]  freed 1024-byte region \n---truncated---",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-416","Use After Free","The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","weakness","Stable","Variant","High",[],[],[],[],[24,26,28],{"_key":25},"DEBIAN-CVE-2026-23427",{"_key":27},"USN-8490-2",{"_key":29},"UBUNTU-CVE-2026-23427",[],[],"2026-04-03T15:15:14.183Z","2026-05-23T16:04:46.898Z","Modified",{"cisa_kev":36,"cisa_ransomware":36,"cisa_vendor":9,"epss_severity":37,"epss_score":38,"severity":39,"severity_score":40,"severity_version":41,"severity_source":42,"severity_vector":43,"severity_status":34},false,"low",0.0029,"critical",9.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[45,51,55,59,63],{"url":46,"sources":47,"tags":49},"https://git.kernel.org/stable/c/b0158d9d6f4ec5941e49a0b812735db2844f9975",[42,48],"nvd",[50],"Patch",{"url":52,"sources":53,"tags":54},"https://git.kernel.org/stable/c/568a25fd7bcdfb2790f7d42aa2a440dca4435c96",[42,48],[50],{"url":56,"sources":57,"tags":58},"https://git.kernel.org/stable/c/a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2",[42,48],[50],{"url":60,"sources":61,"tags":62},"https://git.kernel.org/stable/c/9b0792c3eacf01e67f356d6ef9707b0ae5022419",[42,48],[50],{"url":64,"sources":65,"tags":66},"https://git.kernel.org/stable/c/b425e4d0eb321a1116ddbf39636333181675d8f4",[42,48],[50],[],{"date":69,"score":38,"percentile":70},"2026-07-05",0.20787,[72,76,79,82,85,88,92,95,98,101,104,107,110,113,116,118,121,124,127,130,133,137,140,143,146,150,153,156,159,162,165,168,172,175,178,181,184,187,190,193,196,199,202,205,208,211,214,217,220,223,226,229,232,235,238,241,244,247,250,253,256,259,262,265,268,271,274,277,281,284,287,290,293,296,299,302,305,308,311,314,317,320,323,326,329,332,335,338,341,344],{"date":73,"score":74,"percentile":75},"2026-04-04",0.00018,0.04609,{"date":77,"score":74,"percentile":78},"2026-04-05",0.04603,{"date":80,"score":74,"percentile":81},"2026-04-06",0.04601,{"date":83,"score":74,"percentile":84},"2026-04-07",0.04614,{"date":86,"score":74,"percentile":87},"2026-04-08",0.04649,{"date":89,"score":90,"percentile":91},"2026-04-09",0.00024,0.06405,{"date":93,"score":90,"percentile":94},"2026-04-10",0.06409,{"date":96,"score":90,"percentile":97},"2026-04-11",0.06398,{"date":99,"score":90,"percentile":100},"2026-04-12",0.06392,{"date":102,"score":90,"percentile":103},"2026-04-13",0.06382,{"date":105,"score":90,"percentile":106},"2026-04-14",0.06307,{"date":108,"score":90,"percentile":109},"2026-04-15",0.06315,{"date":111,"score":90,"percentile":112},"2026-04-16",0.06321,{"date":114,"score":90,"percentile":115},"2026-04-17",0.06332,{"date":117,"score":90,"percentile":115},"2026-04-18",{"date":119,"score":90,"percentile":120},"2026-04-19",0.06313,{"date":122,"score":90,"percentile":123},"2026-04-20",0.06291,{"date":125,"score":90,"percentile":126},"2026-04-21",0.0648,{"date":128,"score":90,"percentile":129},"2026-04-22",0.06483,{"date":131,"score":90,"percentile":132},"2026-04-23",0.06504,{"date":134,"score":135,"percentile":136},"2026-04-24",0.00013,0.02338,{"date":138,"score":135,"percentile":139},"2026-04-25",0.0235,{"date":141,"score":135,"percentile":142},"2026-04-26",0.02331,{"date":144,"score":135,"percentile":145},"2026-04-27",0.02345,{"date":147,"score":148,"percentile":149},"2026-04-28",0.00034,0.09773,{"date":151,"score":148,"percentile":152},"2026-04-29",0.09778,{"date":154,"score":148,"percentile":155},"2026-04-30",0.09765,{"date":157,"score":148,"percentile":158},"2026-05-01",0.09725,{"date":160,"score":148,"percentile":161},"2026-05-02",0.09764,{"date":163,"score":148,"percentile":164},"2026-05-03",0.09746,{"date":166,"score":148,"percentile":167},"2026-05-04",0.09702,{"date":169,"score":170,"percentile":171},"2026-05-05",0.00039,0.11415,{"date":173,"score":170,"percentile":174},"2026-05-06",0.11405,{"date":176,"score":170,"percentile":177},"2026-05-07",0.1155,{"date":179,"score":170,"percentile":180},"2026-05-08",0.11565,{"date":182,"score":170,"percentile":183},"2026-05-09",0.11601,{"date":185,"score":170,"percentile":186},"2026-05-10",0.11581,{"date":188,"score":170,"percentile":189},"2026-05-11",0.11568,{"date":191,"score":170,"percentile":192},"2026-05-12",0.1161,{"date":194,"score":170,"percentile":195},"2026-05-13",0.11634,{"date":197,"score":170,"percentile":198},"2026-05-14",0.11669,{"date":200,"score":170,"percentile":201},"2026-05-15",0.11681,{"date":203,"score":170,"percentile":204},"2026-05-16",0.11722,{"date":206,"score":170,"percentile":207},"2026-05-17",0.11689,{"date":209,"score":170,"percentile":210},"2026-05-18",0.11636,{"date":212,"score":170,"percentile":213},"2026-05-19",0.11613,{"date":215,"score":170,"percentile":216},"2026-05-20",0.11607,{"date":218,"score":170,"percentile":219},"2026-05-21",0.11589,{"date":221,"score":170,"percentile":222},"2026-05-22",0.11783,{"date":224,"score":170,"percentile":225},"2026-05-23",0.11762,{"date":227,"score":170,"percentile":228},"2026-05-24",0.11751,{"date":230,"score":170,"percentile":231},"2026-05-25",0.11724,{"date":233,"score":170,"percentile":234},"2026-05-26",0.11715,{"date":236,"score":170,"percentile":237},"2026-05-27",0.11807,{"date":239,"score":170,"percentile":240},"2026-05-28",0.11933,{"date":242,"score":170,"percentile":243},"2026-05-29",0.11994,{"date":245,"score":170,"percentile":246},"2026-05-30",0.11965,{"date":248,"score":170,"percentile":249},"2026-05-31",0.1194,{"date":251,"score":170,"percentile":252},"2026-06-01",0.11913,{"date":254,"score":170,"percentile":255},"2026-06-02",0.11904,{"date":257,"score":170,"percentile":258},"2026-06-03",0.11876,{"date":260,"score":170,"percentile":261},"2026-06-04",0.11897,{"date":263,"score":170,"percentile":264},"2026-06-05",0.11981,{"date":266,"score":170,"percentile":267},"2026-06-06",0.11976,{"date":269,"score":170,"percentile":270},"2026-06-07",0.11938,{"date":272,"score":170,"percentile":273},"2026-06-08",0.11863,{"date":275,"score":170,"percentile":276},"2026-06-09",0.11875,{"date":278,"score":279,"percentile":280},"2026-06-10",0.00045,0.14202,{"date":282,"score":279,"percentile":283},"2026-06-11",0.14242,{"date":285,"score":279,"percentile":286},"2026-06-12",0.14362,{"date":288,"score":279,"percentile":289},"2026-06-13",0.14363,{"date":291,"score":279,"percentile":292},"2026-06-14",0.14338,{"date":294,"score":38,"percentile":295},"2026-06-15",0.20442,{"date":297,"score":38,"percentile":298},"2026-06-16",0.20475,{"date":300,"score":38,"percentile":301},"2026-06-17",0.20476,{"date":303,"score":38,"percentile":304},"2026-06-18",0.20487,{"date":306,"score":38,"percentile":307},"2026-06-19",0.20477,{"date":309,"score":38,"percentile":310},"2026-06-20",0.20465,{"date":312,"score":38,"percentile":313},"2026-06-21",0.20455,{"date":315,"score":38,"percentile":316},"2026-06-22",0.20428,{"date":318,"score":38,"percentile":319},"2026-06-23",0.20489,{"date":321,"score":38,"percentile":322},"2026-06-24",0.20517,{"date":324,"score":38,"percentile":325},"2026-06-25",0.20614,{"date":327,"score":38,"percentile":328},"2026-06-26",0.20647,{"date":330,"score":38,"percentile":331},"2026-06-27",0.20688,{"date":333,"score":38,"percentile":334},"2026-06-28",0.20659,{"date":336,"score":38,"percentile":337},"2026-06-29",0.20662,{"date":339,"score":38,"percentile":340},"2026-06-30",0.20652,{"date":342,"score":38,"percentile":343},"2026-07-01",0.20765,{"date":345,"score":38,"percentile":346},"2026-07-02",0.20763,[348,354],{"source":48,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":349,"cvss_v4_0":9},{"baseScore":350,"baseSeverity":351,"vectorString":352,"impactScore":40,"exploitabilityScore":353},7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",4.6,{"source":42,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":355,"cvss_v4_0":9},{"baseScore":40,"baseSeverity":356,"vectorString":43,"impactScore":40,"exploitabilityScore":357},"CRITICAL",10,[359,390],{"ecosystem":9,"name":360,"vendor":361,"product":361,"cpe_part":362,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":363},"Linux","linux","a",[364,371,375,378,381,384,388],{"version":365,"is_range":366,"range_type":42,"version_start":367,"version_start_type":368,"version_end":369,"version_end_type":370,"fixed_in":9},">= 8df4bcdb0a4232192b2445256c39b787d58ef14d, \u003C b0158d9d6f4ec5941e49a0b812735db2844f9975",true,"8df4bcdb0a4232192b2445256c39b787d58ef14d","including","b0158d9d6f4ec5941e49a0b812735db2844f9975","excluding",{"version":372,"is_range":366,"range_type":42,"version_start":373,"version_start_type":368,"version_end":374,"version_end_type":370,"fixed_in":9},">= c8efcc786146a951091588e5fa7e3c754850cb3c, \u003C 568a25fd7bcdfb2790f7d42aa2a440dca4435c96","c8efcc786146a951091588e5fa7e3c754850cb3c","568a25fd7bcdfb2790f7d42aa2a440dca4435c96",{"version":376,"is_range":366,"range_type":42,"version_start":373,"version_start_type":368,"version_end":377,"version_end_type":370,"fixed_in":9},">= c8efcc786146a951091588e5fa7e3c754850cb3c, \u003C a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2","a5828c14a9e3d5eeed0bcc0a58f0f3fbca0cdcb2",{"version":379,"is_range":366,"range_type":42,"version_start":373,"version_start_type":368,"version_end":380,"version_end_type":370,"fixed_in":9},">= c8efcc786146a951091588e5fa7e3c754850cb3c, \u003C 9b0792c3eacf01e67f356d6ef9707b0ae5022419","9b0792c3eacf01e67f356d6ef9707b0ae5022419",{"version":382,"is_range":366,"range_type":42,"version_start":373,"version_start_type":368,"version_end":383,"version_end_type":370,"fixed_in":9},">= c8efcc786146a951091588e5fa7e3c754850cb3c, \u003C b425e4d0eb321a1116ddbf39636333181675d8f4","b425e4d0eb321a1116ddbf39636333181675d8f4",{"version":385,"is_range":366,"range_type":42,"version_start":386,"version_start_type":368,"version_end":387,"version_end_type":370,"fixed_in":9},">= 6.6.32, \u003C 6.6.130","6.6.32","6.6.130",{"version":389,"is_range":36,"range_type":42,"version_start":389,"version_start_type":368,"version_end":389,"version_end_type":368,"fixed_in":9},"6.9",{"ecosystem":9,"name":391,"vendor":361,"product":392,"cpe_part":362,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":393},"Linux Kernel","linux kernel",[394,397,401,405,409,410,412,414,416,418,420,422],{"version":395,"is_range":366,"range_type":396,"version_start":386,"version_start_type":368,"version_end":387,"version_end_type":370,"fixed_in":9},"gte6.6.32_lt6.6.130","cpe",{"version":398,"is_range":366,"range_type":396,"version_start":399,"version_start_type":368,"version_end":400,"version_end_type":370,"fixed_in":9},"gte6.9.1_lt6.12.78","6.9.1","6.12.78",{"version":402,"is_range":366,"range_type":396,"version_start":403,"version_start_type":368,"version_end":404,"version_end_type":370,"fixed_in":9},"gte6.13_lt6.18.20","6.13","6.18.20",{"version":406,"is_range":366,"range_type":396,"version_start":407,"version_start_type":368,"version_end":408,"version_end_type":370,"fixed_in":9},"gte6.19_lt6.19.10","6.19","6.19.10",{"version":389,"is_range":36,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":411,"is_range":36,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"7.0:rc1",{"version":413,"is_range":36,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"7.0:rc2",{"version":415,"is_range":36,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"7.0:rc3",{"version":417,"is_range":36,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"7.0:rc4",{"version":419,"is_range":36,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"7.0:rc5",{"version":421,"is_range":36,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"7.0:rc6",{"version":423,"is_range":36,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"7.0:rc7"]