Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - ksmbd修正使用中檔案處理的持久 v2 重播中的釋放後使用問題 parse_durable_handle_context() 處理含有 SMB2_FLAGS_REPLAY_OPERATION 的 DURABLE_REQ_V2 內容時會無條件將 dh_info->fp->conn 指派給目前的連線。 ksmbd_lookup_fd_cguid() 未依 fp->conn 篩選因此它會傳回已主動連線的檔案控制代碼。無條件覆寫取代了 fp->conn因此當覆寫連線隨後被釋放時__ksmbd_close_fd() 透過 spin_lock(&fp->conn->llist_lock) 解除參照過時的 fp->conn進而造成釋放後使用。KASAN 報告 [ 7.349357] =========================================== ======================= [ 7.349607] 錯誤KASAN_raw_spin_lock+0x75/0xe0 中的平台釋放後使用 [ 7.349811] 的寫入大小為 4 在 addr ffff8881056ac18c by task kworker/1:2/108 [ 7.350010] [ 7.350064] CPU1 UID0 PID 108 通訊 kworker/1:2 未受污染的 7.0.0-rc3+ #58 PREEMPTLAZY [ 7.350068]硬體名稱QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX、arch_caps fix、1996)BIOS 1.16.3-debian-1.16.3-2 2014 年 4 月 1 日 [ 7.350070] 工作佇列 ksmbd-io handle_ksmbd_work [ 7.350083] 呼叫追踪 [ 7.350087] <TASK> [ 7.350087] dump_stack_lvl+0x64/0x80 [ 7.350094] print_report+0xce/0x660 [7.350100] __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 7.350101] ? __pfx___mod_timer+0x10/0x10 [ 7.350106] ?
    _raw_spin_lock+0x75/0xe0 [ 7.350108] kasan_report+0xce/0x100 [ 7.350109] ? _raw_spin_lock+0x75/0xe0 [7.350114] kasan_check_range+0x105/0x1b0 [ 7.350116] _raw_spin_lock+0x75/0xe0 [ 7.350118]
    __pfx__raw_spin_lock+0x10/0x10 [ 7.350119] ? __call_rcu_common.constprop.0+0x25e/0x780 [ 7.350125] close_id_del_oplock+0x2cc/0x4e0 [ 7.350128] __ksmbd_close_fd+0x27f/0xaf0 [ 7.350131] ksmbd_close_fd+0x135/0x1b0 [ 7.350133] smb2_close+0xb19/0x15b0 [ 7.350142] ? __pfx_smb2_close+0x10/0x10 [7.350143] ? xas_load+0x18/0x270 [ 7.350146] ? _raw_spin_lock+0x84/0xe0 [ 7.350148] ?
    __pfx__raw_spin_lock+0x10/0x10 [ 7.350150] ? _raw_spin_unlock+0xe/0x30 [ 7.350151] ? ksmbd_smb2_check_message+0xeb2/0x24c0 [ 7.350153] ksmbd_tree_conn_lookup+0xcd/0xf0 [ 7.350154] handle_ksmbd_work+0x40f/0x1080 [ 7.350156] process_one_work+0x5fa/0xef0 [ 7.350162] assign_work+0x122/0x3e0 [ 7.350163] worker_thread+0x54b/0xf70 [ 7.350165] __pfx_worker_thread+0x10/0x10 [ 7.350166] kthread+0x346/0x470 [ 7.350170] recalc_sigpending+0x19b/0x230 [ 7.350176] ?
    __pfx_kthread+0x10/0x10 [ 7.350178] ret_from_fork+0x4fb/0x6c0 [ 7.350183] ? __pfx_ret_from_fork+0x10/0x10 [ 7.350185] ? __switch_to+0x36c/0xbe0 [ 7.350188] ? __pfx_kthread+0x10/0x10 [ 7.350190] ret_from_fork_asm+0x1a/0x30 [ 7.350197] </TASK> [ 7.350197] [ 7.355160] 由工作 123 分配[ 7.355261] kasan_save_stack+0x33/0x60 [ 7.355373] kasan_save_track+0x14/ 0x30 [ 7.355484] __kasan_kmalloc+0x8f/0xa0 [7.355593] ksmbd_conn_alloc+0x44/0x6d0 [ 7.355711] ksmbd_kthread_fn+0x243/0xd70 [ 7.355839] kthread+0x346/0x470 [ 7.355942] ret_from_fork+0x4fb/0x6c0 [ 7.356051] ret_from_fork_asm+0x1a/0x30 [7.356164] [ 7.356214] 已由工作 134 釋放[ 7.356305] kasan_save_stack+0x33/0x60 [ 7.356416] kasan_save_track+0x14/0x30 [ 7.356527] kasan_save_free_info+0x3b/0x60 [ 7.356646]
    __kasan_slab_free+0x43/0x70 [ 7.356761] kfree+0x1ca/0x430 [ 7.356862] ksmbd_tcp_disconnect+0x59/0xe0 [7.356993] ksmbd_conn_handler_loop+0x77e/0xd40 [ 7.357138] kthread+0x346/0x470 [ 7.357240] ret_from_fork+0x4fc60 [ 7.357350] ret_from_fork_asm+0x1a/0x30 [ 7.357463] [ 7.357513] 錯誤位址屬於 ffff8881056ac000 的物件 [ 7.357513]該物件屬於大小為 1024 的快取 kmalloc-1k [ 7.357857] 錯誤位址位於[ 7.357857] 內的 396 位元組已釋放 1024 位元組區域
    ---truncated--- (CVE-2026-23427)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2026-23427

high Nessus Plugin ID 304983

版本 1.4