Executive brief
A vulnerability exists in the Linux kernel's ksmbd module, which provides SMB file sharing services. An error in how the system handles file lock cancellations can lead to a system crash or memory corruption. This could potentially allow an attacker to disrupt file sharing operations or impact the stability of the server.
Technical details
A use-after-free (UAF) vulnerability exists in the ksmbd component of the Linux kernel due to improper synchronization during SMB2_LOCK deferred-lock cancellation. When a blocking byte-range lock request is deferred, ksmbd registers asynchronous work. If the lock waiter is woken up while the work state is no longer active (e.g., due to concurrent cancellation), the cleanup path may free the 'file_lock' structure while it is still queued in the async_requests list. A concurrent call to smb2_cancel() can then dereference this freed memory. The fix restructures the cleanup logic to ensure the work is dequeued and serialized before the memory is released.
Affected products
- Linux Linux Kernel 6.1.178, 6.6.145, 6.12.y, 6.13.y, 6.14.y, 6.15.y
Timeline
- 2026-06-06: other: Patch authored
- 2026-07-24: patched: Patch committed to stable tree
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2
- https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e
- https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3
- https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8
- https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9
- https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e