CVE-2026-72381: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-qx34-9c4p-jvq8
Share
CVSS 9.8
Published
Advisory Summary

CVE-2026-72381 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72381 at a Glance

CVE Identifier CVE-2026-72381
GHSA Identifier GHSA-qx34-9c4p-jvq8
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-72381

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72381, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp->owner.name in durable handle owner check Two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistent_id race the fp->owner.name compare-read in ksmbd_vfs_compare_durable_owner() against the kfree() in ksmbd_reopen_durable_fd()'s reopen-success path. fp->owner.name is a standalone kstrdup() buffer whose lifetime is independent of the fp refcount, and the two sites share no lock: the compare reads the buffer while the reopen frees it, so the strcmp() can dereference freed memory. Commit 7ce4fc40018d ("ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd") made the fp->conn claim atomic under global_ft.lock (closing the owner.name double-free and the ksmbd_file write-UAF), but the compare-read versus reopen-free pair was left unserialized. BUG: KASAN: slab-use-after-free in strcmp+0x2c/0x80 Read of size 1 by task kworker strcmp ksmbd_vfs_compare_durable_owner smb2_check_durable_oplock smb2_open Freed by task kworker: kfree ksmbd_reopen_durable_fd smb2_open Allocated by task kworker: kstrdup session_fd_check smb2_session_logoff The buggy address belongs to the cache kmalloc-8 Serialize both sides of the race with fp->f_lock. The global durable file-table lock still protects the durable reconnect claim, but fp->owner.name is per-open state and does not need to block unrelated durable table lookups or reconnects. The teardown is left at its existing location after the reopen-success point so that an __open_id() rollback still retains owner.name for a later legitimate reconnect to verify.

References

NVD — CVE-2026-72381 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72381
git.kernel.org/stable/c/3863716350... WEB
https://git.kernel.org/stable/c/38637163501fd9e2f684b8cd275d0db5d79f37c6
git.kernel.org/stable/c/5a5ac2852c... WEB
https://git.kernel.org/stable/c/5a5ac2852cd326529d02f778bc1aa6184701f4d7
git.kernel.org/stable/c/93d4d46bf9... WEB
https://git.kernel.org/stable/c/93d4d46bf9d442a12ea87278049ec416962c627f
git.kernel.org/stable/c/ed98719be4... WEB
https://git.kernel.org/stable/c/ed98719be41389d416953b8ef9f07a07dfea6b2b
git.kernel.org/stable/c/fb978d7205... WEB
https://git.kernel.org/stable/c/fb978d72052704c6b06c6b0f129fcd60b77169f5

Frequently Asked Questions

What is CVE-2026-72381?
CVE-2026-72381 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72381?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72381?
CVE-2026-72381 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-72381?
CVE-2026-72381 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72381?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qx34-9c4p-jvq8",
  "modified" : "2026-08-17T06:33:26Z",
  "published" : "2026-08-15T06:32:22Z",
  "aliases" : [ "CVE-2026-72381" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of fp->owner.name in durable handle owner check\n\nTwo concurrent SMB2 durable reconnects (DH2C/DHnC) on the same\npersistent_id race the fp->owner.name compare-read in\nksmbd_vfs_compare_durable_owner() against the kfree() in\nksmbd_reopen_durable_fd()'s reopen-success path. fp->owner.name is a\nstandalone kstrdup() buffer whose lifetime is independent of the fp\nrefcount, and the two sites share no lock: the compare reads the buffer\nwhile the reopen frees it, so the strcmp() can dereference freed memory.\n\nCommit 7ce4fc40018d (\"ksmbd: fix durable reconnect double-bind race in\nksmbd_reopen_durable_fd\") made the fp->conn claim atomic under\nglobal_ft.lock (closing the owner.name double-free and the ksmbd_file\nwrite-UAF), but the compare-read versus reopen-free pair was left\nunserialized.\n\n  BUG: KASAN: slab-use-after-free in strcmp+0x2c/0x80\n  Read of size 1 by task kworker\n    strcmp\n    ksmbd_vfs_compare_durable_owner\n    smb2_check_durable_oplock\n    smb2_open\n  Freed by task kworker:\n    kfree\n    ksmbd_reopen_durable_fd\n    smb2_open\n  Allocated by task kworker:\n    kstrdup\n    session_fd_check\n    smb2_session_logoff\n  The buggy address belongs to the cache kmalloc-8\n\nSerialize both sides of the race with fp->f_lock.  The global durable\nfile-table lock still protects the durable reconnect claim, but\nfp->owner.name is per-open state and does not need to block unrelated\ndurable table lookups or reconnects.  The teardown is left at its\nexisting location after the reopen-success point so that an __open_id()\nrollback still retains owner.name for a later legitimate reconnect to\nverify.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72381"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/38637163501fd9e2f684b8cd275d0db5d79f37c6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5a5ac2852cd326529d02f778bc1aa6184701f4d7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/93d4d46bf9d442a12ea87278049ec416962c627f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ed98719be41389d416953b8ef9f07a07dfea6b2b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fb978d72052704c6b06c6b0f129fcd60b77169f5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:22:11Z"
  }
}