Executive brief
ksmbd is the Linux kernel's SMB file-sharing server component. A race condition in the lock-handling code allows an attacker with network access to send specially crafted lock requests that trigger use-after-free and double-free memory corruption, potentially leading to denial of service or arbitrary code execution on systems running affected kernel versions.
Technical details
The vulnerability is a use-after-free and double-free in the smb2_lock() handler in fs/smb/server/smb2pdu.c. When processing an array of SMB2_LOCK requests, granted locks are immediately published to connection-wide and file-wide lock lists, but remain tracked on a local rollback list. If a subsequent lock in the same batch fails validation or execution, a concurrent UNLOCK request from another connection thread can find and free the already-published lock before the rollback handler executes, leading to double-free of both the ksmbd_lock structure and the underlying file_lock. The fix defers publication of granted locks to the global lists until after the entire batch has been successfully processed, eliminating the race window. The vulnerability affects the SMB3 locking mechanism introduced in commit e2f34481b24d.
Affected products
- Linux Linux kernel all versions with ksmbd (5.x and later)
Timeline
- 2026-09-17: disclosed: CVE-2026-90162 published to NVD
- 2026-08-17: patched: Patch merged by Namjae Jeon (commit 29f74f0f2e6df3b393b7b66e810136d0c64e3c59)
- 2026-09-14: other: Backported to stable kernel trees by Greg Kroah-Hartman