Linux Kernel ksmbd SMB server Vulnerability Rated 8.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-90162

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer publishing granted locks to prevent UAF/double-free race

In smb2_lock(), mid-batch granted locks are published to connection-wide

(conn->lock_list) and file-wide (fp->lock_list) lists immediately upon

vfs_lock_file() success, while also remaining tracked on the stack-local

rollback_list.

If a subsequent element in the same SMB2_LOCK request array fails

validation or execution, the thread jumps to out: and walks

rollback_list to undo previously granted locks. However, because the

granted lock was already published to conn->lock_list, a concurrent

UNLOCK request on the same connection can find the lock object and

kfree() it before the rollback loop executes.

When the granting thread subsequently walks rollback_list, it

dereferences and frees the already-freed ksmbd_lock structure, resulting

in a Use-After-Free and Double-Free (on both ksmbd_lock and struct

file_lock).

Fix this by deferring the publication of granted locks to

conn->lock_list and fp->lock_list until after the entire array of lock

elements has been processed without error. Mid-batch grants remain

tracked exclusively on the request-local rollback_list until the whole

batch succeeds, eliminating the race window. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References