Executive brief
A vulnerability was identified in the Linux kernel's ksmbd component, which provides SMB file sharing services. An authenticated user could potentially cause a system crash or instability by sending specific duplicate cancellation requests for file locks. This issue affects the reliability of the file server and could be used to disrupt business operations.
Technical details
A use-after-free (UAF) vulnerability exists in the ksmbd component of the Linux kernel due to improper state management during SMB2_CANCEL operations. When a deferred byte-range lock (SMB2_LOCK) is cancelled, the associated 'file_lock' structure is freed, but the asynchronous work item may remain on the connection's request list without being properly unlinked. If a second SMB2_CANCEL request for the same AsyncId is received before the connection is torn down, the kernel attempts to re-run the cancellation function on the already-freed memory. This can be triggered by an authenticated SMB client and results in a slab use-after-free, typically leading to a kernel panic (DoS). The fix introduces a state check to ensure cancelled work items are not processed a second time.
Affected products
- Linux Linux Kernel ksmbd module
Timeline
- 2026-06-01: other: Patch authored
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd
- https://git.kernel.org/stable/c/14d2eee0193ac3cd1bf3d014373449f0b8d35d6d
- https://git.kernel.org/stable/c/2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694
- https://git.kernel.org/stable/c/89ae9df09d2c1fb4a4eb495c113a7ce1dca34147
- https://git.kernel.org/stable/c/b7063c7426ea5a4d15e01b60538718765392f49d
- https://git.kernel.org/stable/c/f580d27e8928828693df44ba2db0fffdbe11dfea