CVE-2022-47939: Linux ksmbd SMB2_TREE_DISCONNECT use-after-free

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction required, and a high EPSS percentile make this a critical pre-auth kernel flaw despite no KEV listing.

What it is

The ksmbd SMB server in the Linux kernel (5.15 through 5.19 before 5.19.2) contains a use-after-free in fs/ksmbd/smb2pdu.c triggered by the SMB2_TREE_DISCONNECT command, leading to a kernel OOPS. Because ksmbd is a network-facing SMB server, a remote unauthenticated attacker can reach the flaw, making it a serious pre-auth kernel memory corruption issue.

Impact

An attacker can corrupt kernel memory and crash the system, and the use-after-free primitive may allow further kernel exploitation depending on memory layout control. The CVSS vector indicates high confidentiality, integrity and availability impact.

Attack surface

Reached over the network via SMB2 traffic to a host running ksmbd; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. The flaw is in the SMB2_TREE_DISCONNECT handling path.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is high (0.46428, ~98.8th percentile), indicating elevated likelihood of exploitation activity. References include patch commits and third-party advisories but no public exploit tag.

What to do

• Upgrade the Linux kernel to 5.19.2 or later, which contains the fix commit cf6531d98190fa2cf92a6d8bbc8af0a4740a223c.
• If ksmbd is not required, disable or do not load the ksmbd module to remove the attack surface.
• Restrict SMB (TCP 445/139) exposure to trusted networks and block it at the perimeter where possible.
• Apply vendor backports for distributions shipping kernels in the 5.15-5.19 range.
• Monitor for kernel OOPS/panic events on SMB servers as an indicator of attempted or successful triggering.

Detection

• Alert on kernel OOPS, panic or use-after-free reports referencing fs/ksmbd/smb2pdu.c or SMB2_TREE_DISCONNECT.
• Monitor SMB2 TREE_DISCONNECT requests, especially unusual volumes or malformed sequences from unexpected sources.
• Track ksmbd process crashes and unexpected host reboots on systems exposing SMB.
• Review network logs for SMB connections from untrusted or anomalous external addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.