Executive brief
ksmbd is a Linux kernel SMB server that handles file locking and exclusive access permissions (oplocks). A race condition allows a file close operation to interfere with another thread's oplock lock transition, potentially leaving the lock in an inconsistent state that could affect file access control and data consistency on shares served by this component.
Technical details
The vulnerability is a race condition in the ksmbd oplock handling code, specifically in the close_id_del_oplock function. The issue occurs when a file close operation releases a pending_break lock while another thread is trying to acquire oplock ownership via test_and_set_bit(). Without proper serialization, the close can transition oplock state to OPLOCK_CLOSING while another breaker simultaneously acquires ownership and overwrites it with OPLOCK_ACK_WAIT, causing a broken invariant for a dying opinfo. The fix adds a spin lock (state_lock) to serialize the opinfo state transitions and pending_break acquisition, ensures OPLOCK_CLOSING becomes terminal once the opinfo is removed from the inode list, and prevents ACK and timeout paths from replacing this terminal state. The attack vector is local and requires no special privileges.
Affected products
- Linux Linux kernel affected versions not explicitly specified in advisory
Timeline
- 2026-09-17: disclosed
- 2026-07-28: patched: fix committed upstream
- 2026-08-17: other: fix committed to stable