Executive brief
The ksmbd SMB server component in the Linux kernel failed to safely handle deferred file locks when asynchronous operations encountered errors. If memory allocation or work registration failed, the code could dereference a null pointer and leave freed locks in the VFS blocked-lock state, potentially causing kernel crashes or memory corruption.
Technical details
The vulnerability exists in the SMB2 lock handling code (fs/smb/server/smb2pdu.c) in the smb2_lock() function. When vfs_lock_file() defers a lock, the code placed the ksmbd_lock structure on a rollback list before allocating and registering the asynchronous work. If either kmalloc() or ksmbd_queue_work() failed, the rollback cleanup code assumed smb_lock->conn was initialized and dereferenced a null pointer. Additionally, the deferred file_lock remained linked into VFS blocked-lock state while being freed, causing use-after-free conditions. The fix delays adding the lock to the rollback list until after async setup completes successfully, and adds explicit unblock/wake operations before freeing the lock on error paths.
Affected products
- Linux Linux kernel multiple versions
Timeline
- 2026-09-17: disclosed
- 2026-07-29: patched: Upstream fix committed
- 2026-08-17: patched: Committed to stable tree