ANT-2026-14WRNADB · torvalds/linux

use-after-free high

Severity Claude high · Security research firm - · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis of this finding, sealed at approval.

ANT-2026-14WRNADB: ksmbd: use-after-free of share_conf via multichannel LOGOFF race

SMB3 multichannel: SESSION_LOGOFF on connection A calls ksmbd_conn_wait_idle(conn), draining only A's request counter. In-flight requests on bound connection B still hold tree_conn references via work->tcon while __ksmbd_tree_conn_disconnect() drops the share_conf reference before checking tree_conn->refcount, freeing share_conf under them. Fix combines the share_conf put with the tree_conn free (last-reference only). Reported by Anthropic to security@kernel.org on 2026-03-05; fixed upstream 2026-03-18 by commit 5258572aa5fd, authored by the Anthropic reporter.

Target

Project: linux
Location: fs/smb/server/mgmt/tree_connect.c:__ksmbd_tree_conn_disconnect
Discovery: static analysis — not yet dynamically reproduced

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. A trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-14WRNADB.

Reference: ANT-2026-14WRNADB
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

UPSTREAM FIX

The change that resolved this finding.

diff --git a/fs/smb/server/mgmt/tree_connect.c b/fs/smb/server/mgmt/tree_connect.c
index a72d7e42a6c278..58e5b8592da46f 100644
--- a/fs/smb/server/mgmt/tree_connect.c
+++ b/fs/smb/server/mgmt/tree_connect.c
@@ -102,8 +102,10 @@ ksmbd_tree_conn_connect(struct ksmbd_work *work, const char *share_name)
 
 void ksmbd_tree_connect_put(struct ksmbd_tree_connect *tcon)
 {
-	if (atomic_dec_and_test(&tcon->refcount))
+	if (atomic_dec_and_test(&tcon->refcount)) {
+		ksmbd_share_config_put(tcon->share_conf);
 		kfree(tcon);
+	}
 }
 
 static int __ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
@@ -113,10 +115,11 @@ static int __ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
 
 	ret = ksmbd_ipc_tree_disconnect_request(sess->id, tree_conn->id);
 	ksmbd_release_tree_conn_id(sess, tree_conn->id);
-	ksmbd_share_config_put(tree_conn->share_conf);
 	ksmbd_counter_dec(KSMBD_COUNTER_TREE_CONNS);
-	if (atomic_dec_and_test(&tree_conn->refcount))
+	if (atomic_dec_and_test(&tree_conn->refcount)) {
+		ksmbd_share_config_put(tree_conn->share_conf);
 		kfree(tree_conn);
+	}
 	return ret;
 }

https://github.com/torvalds/linux/commit/5258572aa5fd5a7ed01b123b28241e0281b6fb9b

ADVISORY

https://github.com/torvalds/linux/commit/5258572aa5fd (mainline 2026-03-18, Signed-off-by Nicholas Carlini, Acked-by Namjae Jeon)

TIMELINE

Dates from discovery through public reveal.

2026-03-05 Sent to maintainer
2026-03-22 Patch released
2026-03-29 Reported to tracker
2026-05-08 Maintainer acknowledged
2026-07-20 Publicly revealed

PROVENANCE

SHA-3-512 hash:

48e7eaaca18de45088a6e035e6a8abe203337609a056099f54a6d03f8d6934d666009e98e6b7468098f4f5bfd2c7c236bb4ae3847be8faefea282ffbae0919f7

Committed 2026-05-08 09:37 PT

Revealed 2026-07-20 22:17 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-14WRNADB",
  "bug_class": null,
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:45:53+00:00",
  "description": null,
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "linux",
  "reproduction": null,
  "technical_details": null,
  "title": "ksbmd one",
  "vendor_severity": null
}