ZDI-22-1690 describes a use-after-free in ksmbd, the in-kernel SMB server added in Linux 5.15, that an unauthenticated attacker triggers with an SMB2_TREE_DISCONNECT request to run code in kernel context (CVE-2022-47939, CVSS 10.0 by ZDI’s count, reported by the Thalium team in July).
Before you panic: the fix already landed in 5.15.61, 5.18.18 and 5.19.2 back in August, and only systems that actually load ksmbd are exposed, which Hacker News commenters spotted in the advisory while oss-sec was still asking for details.
Red Hat says none of its products ship or enable ksmbd, and modinfo ksmbd answering “not found” tells you your own kernel is off the hook too.
Still, an unauthenticated network protocol parser running in ring 0 is exactly as much fun as it sounds.
