Executive brief
The Linux kernel's ksmbd server (used for SMB/CIFS file sharing) had a logic error in its byte-range lock enforcement. It would incorrectly skip mandatory lock checks for one-byte file operations (reads, writes, truncates), allowing operations to bypass file locks that should have blocked them. This could permit unauthorized access to locked file content on systems using ksmbd for file sharing.
Technical details
The vulnerability is a logic error in the check_lock_range() function within fs/smb/server/vfs.c. The function uses inclusive ranges where start == end represents a valid single-byte range, but included a shortcut that skipped all lock checks when start == end. This caused one-byte reads, writes, copy-chunk operations, and truncate operations to proceed without verifying conflicting byte-range locks. An attacker with file access could bypass POSIX locks and access locked portions of files. The fix removes the erroneous shortcut, ensuring all byte-range lock checks are performed regardless of range size. The vulnerability affects all Linux kernel versions with ksmbd support.
Affected products
- Linux Linux kernel all versions with ksmbd support
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Upstream patch merged in stable trees