CVE-2026-72492

CVE-2026-72492 is a use-after-free in ksmbd's oplock and lease granting logic that merits attention far beyond its low EPSS score suggests. The vulnerability lives in same_client_has_lease(), which returns a bare pointer into a locked list (ci->m_op_list), releases the lock (ci->m_lock), and then the caller dereferences that pointer. Between lock release and dereference, any concurrent close() can traverse the same list, drop the final reference on the lease object, and free it—leaving the caller holding a dangling pointer. The fix correctly introduces reference capture at selection time and releases after the critical copy window. But the deeper problem is that this is not an isolated mistake. The same lock-then-return-then-use anti-pattern has surfaced repeatedly in kernel subsystems over two decades—file locking, network namespaces, device drivers—each time patched locally without the lesson propagating into enforceable constraints. Ksmbd inherited this code from userspace SMB implementations that were never audited against kernel threat models, where a use-after-free crashes a daemon rather than the entire kernel. The CVSS 8.8 is accurate: a kernel UAF in a network-facing subsystem touching credential state and file handles creates a realistic privilege escalation path through slab grooming under load. The EPSS score of 0.00477 measures current exploitability, not blast radius—exploitation difficulty and exploitation impact are separable. Your immediate actions: audit all call sites of same_client_has_lease() and functionally equivalent functions for the same lock-then-return pattern. Extend the audit to ci->m_op_list mutation paths—are there concurrent operations that can traverse or modify that list outside the identified sequence? Prioritize the legacy SMB1 and compound request handlers, which are maintained conservatively but audited lightly; if the same pattern exists there, timing characteristics may differ enough to change the exploitability calculus. The remediation metric that matters is how many call sites now use safe reference semantics across the entire oplock/lease granting path, not just whether this CVE is patched.

Reviewed through automated stages and approved by a human before publication.