PT-2026-64658 · Linux · Linux

CVE-2026-64437

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of a deferred file lock on SMB2 CLOSE then SMB2 CANCEL
Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file lock on double SMB2 CANCEL") made smb2 cancel() skip a work whose state is KSMBD WORK CANCELLED, so its cancel fn cannot be fired a second time. But KSMBD WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too:
SMB2 CLOSE on the locking handle -> set close state blocked works() sets the deferred work's state to KSMBD WORK CLOSED and wakes the smb2 lock() worker. The worker takes the non-ACTIVE early-exit, locks free lock()s the file lock and, because the state is not KSMBD WORK CANCELLED, takes the STATUS RANGE NOT LOCKED branch with "goto out2" -- which, like the cancelled branch, skips release async work(). The work stays on conn->async requests with a live cancel fn = smb2 remove blocked lock pointing at the freed file lock.
A subsequent SMB2 CANCEL for the same AsyncId then passes the KSMBD WORK CANCELLED-only guard (its state is KSMBD WORK CLOSED), so smb2 cancel() fires cancel fn again over the freed file lock -- the same use-after-free fixed, via SMB2 CLOSE instead of a first SMB2 CANCEL:
BUG: KASAN: slab-use-after-free in locks delete block locks delete block locks delete block ksmbd vfs posix lock unblock smb2 remove blocked lock smb2 cancel <- 2nd SMB2 CANCEL fires cancel fn handle ksmbd work Allocated by ...: locks alloc lock <- smb2 lock Freed by ...: locks free lock <- smb2 lock (non-ACTIVE early-exit) ... cache file lock cache of size 192
Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2 CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger.
Only an ACTIVE deferred work may have its cancel fn fired: both terminal states (CANCELLED and CLOSED) reach the smb2 lock() early-exit that frees the file lock and skips release async work(). Guard on KSMBD WORK ACTIVE so any non-active work is skipped.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64437

Produtos afetados

Linux