Critical 9.8Published Jun 24, 2026

CVE-2026-53046ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine

Updated under an hour ago (Oct 28, 2026, 6:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and immediately frees the request while the hardware DMA operation is still in flight. The DMA completion callback then dereferences freed memory, causing a NULL pointer crash: pc : qce_skcipher_done+0x24/0x174 lr : vchan_complete+0x230/0x27c ... el1h_64_irq+0x68/0x6c ksmbd_free_work_struct+0x20/0x118 [ksmbd] ksmbd_exit_file_cache+0x694/0xa4c [ksmbd] Use the standard crypto_wait_req() pattern with crypto_req_done() as the completion callback, matching the approach used by the SMB client in fs/smb/client/smb2ops.c. This properly handles both synchronous engines (immediate return) and async engines (-EINPROGRESS followed by callback notification).

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 57b47231055b431ed0a1a55f33cac32981564405; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before cc2da381875d4a67026e4c8feb3dba51a2a2d1bc; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 8fcefe840fa8c14ce667768e5b043286ac3bbcbe; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 8ef183216feaa24b66b940510d8b68f680eb56e9; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 7164b3953cefd540e7ebca828c793bc6869cfbc4; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before b46aa129fa2807bfe1545fe74d9295d53c51520b; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 3e298897f41c61450c2e7a4f457e8b2485eb35b3	CNA record
linux linux_kernel linux:linux_kernel	from 5.15 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/57b47231055b431ed0a1a55f33cac32981564405	patch
https://git.kernel.org/stable/c/cc2da381875d4a67026e4c8feb3dba51a2a2d1bc	patch
https://git.kernel.org/stable/c/8fcefe840fa8c14ce667768e5b043286ac3bbcbe	patch
https://git.kernel.org/stable/c/8ef183216feaa24b66b940510d8b68f680eb56e9	patch
https://git.kernel.org/stable/c/7164b3953cefd540e7ebca828c793bc6869cfbc4	patch
https://git.kernel.org/stable/c/b46aa129fa2807bfe1545fe74d9295d53c51520b	patch
https://git.kernel.org/stable/c/3e298897f41c61450c2e7a4f457e8b2485eb35b3	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.