Executive brief
The Linux kernel's SMB server implementation (ksmbd) contains a memory safety bug in its file locking mechanism. When file locks are released or files are closed, the code can free data structures that are still referenced by the VFS (Virtual File System) layer, leading to use-after-free and kernel crashes. This affects any system running ksmbd that handles SMB file sharing requests.
Technical details
The vulnerability is a use-after-free and object lifetime mismatch in ksmbd's byte-range locking code. When file_lock objects are retained by ksmbd for lock bookkeeping, they can remain part of the VFS blocked-request graph via flc_blocked_requests. The ksmbd code frees these file_lock structures in __ksmbd_close_fd() and cross-request unlock paths without detaching them from the blocked-request graph, causing locks_release_private() to hit a BUG_ON assertion when dependent waiters are still attached. Additionally, freed ksmbd_lock objects remain reachable through request-local llist pointers. The fix detaches file_lock objects from the blocked-request graph before freeing (via locks_delete_block()), removes llist entries from published locks, and uses safe list iteration during rollback. Attack vector is local or network-adjacent through SMB protocol requests.
Affected products
- Linux Linux Kernel affected versions depend on ksmbd module presence; patch addresses commit d63528eb0d43 and later
Timeline
- 2026-09-17: disclosed: Published to NVD
- 2026-08-14: patched: Upstream fix committed by Namjae Jeon
- 2026-09-14: patched: Backported to stable kernel trees