Ubuntu LSN-0121-1: ksmbd Use-After-Free and nf_conntrack_h323 Flaws Patched via Kernel Livepatch — Detection and Remediation Guide

---
title: ksmbd Kernel SMB Server Module Loaded or Daemon Started
id: 1b7c2f44-9a3e-4d51-b6a2-8e1f0c4d5a7b
status: experimental
description: Detects loading of the ksmbd kernel module or execution of the ksmbd.mountd userspace daemon. ksmbd exposes an in-kernel SMB3 parser on TCP/445 and was patched for multiple use-after-free flaws in Ubuntu LSN-0121-1. Unauthorized ksmbd activation should be investigated as either shadow service deployment or attacker setup of a kernel-level file-sharing primitive.
references:
  - https://ubuntu.com/security/notices/LSN-0121-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.lateral_movement
  - attack.t1021.002
logsource:
  product: linux
  category: process_creation
detection:
  selection_module:
    CommandLine|contains:
      - 'modprobe ksmbd'
      - 'insmod ksmbd'
  selection_daemon:
    Image|endswith:
      - '/ksmbd.mountd'
      - '/ksmbd.adduser'
  condition: 1 of selection_*
falsepositives:
  - Legitimate NAS/file-serving appliances intentionally running ksmbd
level: high
---
title: H.323 Netfilter Conntrack Helper Loaded
id: 3e9d1a56-7c4b-4f28-a9e3-2d6b8f0c1e94
status: experimental
description: Detects loading of the nf_conntrack_h323 kernel module or explicit assignment of the H.323 conntrack helper. The helper parses attacker-controlled Q.931 packet data and was patched for a zero-length underflow in DecodeQ931() (Ubuntu LSN-0121-1). Its presence outside of known VoIP gateway infrastructure warrants investigation.
references:
  - https://ubuntu.com/security/notices/LSN-0121-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1210
logsource:
  product: linux
  category: process_creation
detection:
  selection_modprobe:
    CommandLine|contains:
      - 'modprobe nf_conntrack_h323'
      - 'insmod nf_conntrack_h323'
  selection_helper:
    CommandLine|contains:
      - '--helper h323'
      - 'ct helper h323'
  condition: 1 of selection_*
falsepositives:
  - VoIP gateways, SBCs, and PBX infrastructure legitimately using H.323 NAT traversal
level: medium
---
title: Kernel Memory Corruption Signature in ksmbd or H.323 Code Path
id: 5f2a8c13-4d6e-4b79-9c1a-7e3d5b8a2f60
status: experimental
description: Detects kernel log signatures consistent with memory-safety faults (KASAN reports, general protection faults, BUG/Oops) in ksmbd or nf_conntrack_h323 code paths. Repeated occurrences indicate possible exploitation attempts against the use-after-free or out-of-bounds flaws fixed in Ubuntu LSN-0121-1 and should trigger DFIR triage of the host.
references:
  - https://ubuntu.com/security/notices/LSN-0121-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1210
logsource:
  product: linux
  service: kern
detection:
  selection_fault:
    - 'BUG: KASAN'
    - 'use-after-free'
    - 'general protection fault'
    - 'kernel BUG at'
  selection_component:
    - 'ksmbd'
    - 'smb2_get_ksmbd_tcon'
    - 'ipc_msg_send_request'
    - 'nf_conntrack_h323'
    - 'DecodeQ931'
  condition: selection_fault and selection_component
falsepositives:
  - Rare; kernel faults in these subsystems are inherently anomalous on production hosts
level: critical

// Hunt 1: ksmbd / H.323 helper module activation and kernel fault indicators (Syslog)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any (
    "modprobe ksmbd", "ksmbd.mountd", "ksmbd.adduser",
    "modprobe nf_conntrack_h323", "--helper h323", "ct helper h323",
    "use-after-free", "general protection fault", "BUG: KASAN")
| project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 2: Kernel oops/BUG lines referencing the vulnerable subsystems — repeated faults = possible exploit attempts
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("ksmbd", "nf_conntrack_h323", "DecodeQ931", "smb2_get_ksmbd_tcon", "ipc_msg_send_request")
  and SyslogMessage has_any ("BUG", "Oops", "use-after-free", "protection fault", "Call Trace")
| summarize FaultCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Computer, bin(TimeGenerated, 1h)
| where FaultCount >= 2
| order by FaultCount desc;

// Hunt 3 (MDE on Linux): Process execution loading the vulnerable modules
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("modprobe", "insmod", "ksmbd.mountd")
| where ProcessCommandLine has_any ("ksmbd", "nf_conntrack_h323")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc;

-- Hunt: Inventory ksmbd / nf_conntrack_h323 exposure and livepatch status (Linux)
-- Source 1: loaded kernel modules from /proc/modules
LET modules = SELECT
    split_string(string=Line, sep=" ", max_splits=2)[0] AS ModuleName
FROM read_file(filenames="/proc/modules")
WHERE ModuleName =~ "ksmbd|nf_conntrack_h323"

SELECT
    "loaded_module" AS Finding,
    ModuleName AS Detail,
    timestamp(epoch=now()) AS SeenAt
FROM modules

-- Source 2: check whether Canonical Livepatch reports patches applied
UNION ALL
SELECT
    "livepatch_status" AS Finding,
    stdout AS Detail,
    timestamp(epoch=now()) AS SeenAt
FROM execve(argv=["/usr/bin/canonical-livepatch", "status", "--format", "json"])

#!/bin/bash
# LSN-0121-1 verification and mitigation — Ubuntu hosts
# Run as root. Checks exposure, applies fixes, and reports status.

set -u
echo "=== [1] Checking for vulnerable module exposure ==="

KSMBD_LOADED=$(lsmod | awk '{print $1}' | grep -c '^ksmbd$' || true)
H323_LOADED=$(lsmod | awk '{print $1}' | grep -c '^nf_conntrack_h323$' || true)
HELPER_SYSCTL=$(sysctl -n net.netfilter.nf_conntrack_helper 2>/dev/null || echo "n/a")

echo "ksmbd loaded:            ${KSMBD_LOADED}"
echo "nf_conntrack_h323 loaded: ${H323_LOADED}"
echo "nf_conntrack_helper:      ${HELPER_SYSCTL}"

echo "=== [2] Checking Canonical Livepatch status ==="
if command -v canonical-livepatch >/dev/null 2>&1; then
  canonical-livepatch status --format=machine-readable || canonical-livepatch status
else
  echo "canonical-livepatch not installed. Consider: snap install canonical-livepatch && canonical-livepatch enable <TOKEN>"
fi

echo "=== [3] Applying kernel package updates (fallback if no livepatch) ==="
apt-get update -qq
apt-get install --only-upgrade -y linux-image-$(uname -r | sed 's/-generic.*//')-generic 2>/dev/null || \
  apt-get upgrade -y linux-image-generic

echo "=== [4] Mitigation: unload unused vulnerable modules ==="
# Only unload ksmbd if no ksmbd.mountd daemon is active (i.e., not actually serving SMB)
if [ "${KSMBD_LOADED}" -gt 0 ] && ! pgrep -x ksmbd.mountd >/dev/null 2>&1; then
  modprobe -r ksmbd && echo "ksmbd unloaded (no active daemon)" || echo "WARN: could not unload ksmbd"
  echo -e "# LSN-0121-1 mitigation\nblacklist ksmbd" > /etc/modprobe.d/blacklist-ksmbd.conf
else
  echo "ksmbd in active use or not loaded — patch via livepatch/reboot instead of unloading"
fi

if [ "${H323_LOADED}" -gt 0 ]; then
  echo "nf_conntrack_h323 is loaded. If H.323 NAT traversal is not required:"
  modprobe -r nf_conntrack_h323 && echo "nf_conntrack_h323 unloaded" || echo "WARN: unload failed (may be in use by conntrack)"
  echo -e "# LSN-0121-1 mitigation\nblacklist nf_conntrack_h323" > /etc/modprobe.d/blacklist-h323.conf
fi

echo "=== [5] Hardening: ensure automatic conntrack helper assignment stays disabled ==="
sysctl -w net.netfilter.nf_conntrack_helper=0
grep -q 'nf_conntrack_helper' /etc/sysctl.d/99-security.conf 2>/dev/null || \
  echo 'net.netfilter.nf_conntrack_helper=0' >> /etc/sysctl.d/99-security.conf

echo "=== [6] Verification ==="
lsmod | grep -E '^(ksmbd|nf_conntrack_h323)' && echo "WARNING: vulnerable modules still loaded — schedule a reboot into the patched kernel" || \
  echo "OK: neither ksmbd nor nf_conntrack_h323 is loaded"
echo "Done. If ksmbd must remain in service, confirm livepatch applied or reboot into the updated kernel."