Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ksmbd修复活动文件句柄 parse_durable_handle_context() 的持久 v2 重播中的释放后使用在处理包含 SMB2_FLAGS_REPLAY_OPERATION 的 DURABLE_REQ_V2 上下文时会无条件地将 dh_info->fp->conn 分配给当前连接。 ksmbd_lookup_fd_cguid() 不按 fp->conn 筛选因此其返回已处于活动连接状态的文件句柄。无条件覆盖替换了 fp->conn当随后释放覆盖连接时__ksmbd_close_fd() 通过 spin_lock(&fp->conn->llist_lock) 取消引用过时的 fp->conn造成释放后使用。KASAN 报告 [ 7.349357] =========================================== ======================= [ 7.349607] BUGKASAN_raw_spin_lock+0x75/0xe0 中的 slab-use-after-free [ 7.349811] 的写入地址 ffff8881056ac18c 的大小为 kworker/ 任务1:2/108 [ 7.350010] [ 7.350064] CPU: 1 UID: 0 PID: 108 Comm: kworker/1:2 未受感染 7.0.0-rc3+ #58 PREEMPTLAZY [ 7.350068]硬件名称QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps 补丁, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 7.350070] 工作队列ksmbd-io handle_ksmbd_work [ 7.350083] 调用跟踪[ 7.350087] <TASK> [ 7.350087] dump_stack_lvl+0x64/0x80 [ 7.350094] print_report+0xce/0x660 [7.350100] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 7.350101] ? __pfx___mod_timer+0x10/0x10 [ 7.350106] ?
    _raw_spin_lock+0x75/0xe0 [ 7.350108] kasan_report+0xce/0x100 [ 7.350109] ? _raw_spin_lock+0x75/0xe0 [7.350114] kasan_check_range+0x105/0x1b0 [ 7.350116] _raw_spin_lock+0x75/0xe0 [ 7.350118] ?
    __pfx__raw_spin_lock+0x10/0x10 [ 7.350119] ? __call_rcu_common.constprop.0+0x25e/0x780 [ 7.350125] ? close_id_del_oplock+0x2cc/0x4e0 [ 7.350128] __ksmbd_close_fd+0x27f/0xaf0 [ 7.350131] ksmbd_close_fd+0x135/0x1b0 [ 7.350133] smb2_close+0xb19/0x15b0 [ 7.350142] ? __pfx_smb2_close+0x10/0x10 [7.350143] ? xas_load+0x18/0x270 [ 7.350146] _raw_spin_lock+0x84/0xe0 [ 7.350148] ?
    __pfx__raw_spin_lock+0x10/0x10 [ 7.350150] ? _raw_spin_unlock+0xe/0x30 [ 7.350151] ksmbd_smb2_check_message+0xeb2/0x24c0 [ 7.350153] ? ksmbd_tree_conn_lookup+0xcd/0xf0 [ 7.350154] handle_ksmbd_work+0x40f/0x1080 [ 7.350156] process_one_work+0x5fa/0xef0 [ 7.350162] ? assign_work+0x122/0x3e0 [ 7.350163] worker_thread+0x54b/0xf70 [ 7.350165] ? __pfx_worker_thread+0x10/0x10 [ 7.350166] kthread+0x346/0x470 [ 7.350170] ? recalc_sigpending+0x19b/0x230 [ 7.350176] ?
    __pfx_kthread+0x10/0x10 [ 7.350178] ret_from_fork+0x4fb/0x6c0 [ 7.350183] ? __pfx_ret_from_fork+0x10/0x10 [ 7.350185] ? __switch_to+0x36c/0xbe0 [ 7.350188] ? __pfx_kthread+0x10/0x10 [ 7.350190] ret_from_fork_asm+0x1a/0x30 [ 7.350197] </TASK> [ 7.350197] [ 7.355160] 由任务 123 分配[ 7.355261] kasan_save_stack+0x33/0x60 [ 7.355373] kasan_save_track+0x14/ 0x30 [ 7.355484] __kasan_kmalloc+0x8f/0xa0 [7.355593] ksmbd_conn_alloc+0x44/0x6d0 [ 7.355711] ksmbd_kthread_fn+0x243/0xd70 [ 7.355839] kthread+0x346/0x470 [ 7.355942] ret_from_fork+0x4fb/0x6c0 [ 7.356051] ret_from_fork_asm+0x1a/0x30 [7.356164] [ 7.356214] 由任务 134 释放[ 7.356305] kasan_save_stack+0x33/0x60 [ 7.356416] kasan_save_track+0x14/0x30 [ 7.356527] kasan_save_free_info+0x3b/0x60 [ 7.356646]
     7.356761... 7.356862​7.356993​ 7.357138​ 7.357240​ [ 7.357350] ret_from_fork_asm+0x1a/0x30 [ 7.357463] [ 7.357513] 有缺陷的地址属于 ffff8881056ac000 的对象 [ 7.357513] 属于大小为 1024 的 kmalloc-1k [ 7.357857] 有缺陷的地址位于[ 7.357857] 内的 396 字节释放了 1024 字节区域
    ---truncated--- (CVE-2026-23427)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2026-23427

high Nessus 插件 ID 304983

版本 1.4