Linux Kernel ksmbd Concurrent smb2 Tree Disconnect Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's ksmbd component, specifically related to concurrent SMB2 tree disconnection processes. This issue arises from a race condition that can be exploited when multiple disconnection requests are processed simultaneously, leading to undefined behavior.

Impact

Exploitation of this vulnerability can result in a use-after-free condition, potentially allowing for arbitrary code execution or memory corruption.

Reproduction

To reproduce this vulnerability, initiate concurrent SMB2 tree disconnection requests in the ksmbd component of the Linux kernel. This can be done by sending multiple disconnection requests at the same time, which will create a race condition and trigger the use-after-free vulnerability.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. The specific commit addressing this issue is 30210947a343b6b3ca13adc9bfc88e1543e16dd5.