PT-2026-34349 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31444

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The smb grant oplock() function in ksmbd contains two issues. First, a use-after-free occurs when opinfo is linked into ci->m op list before add lease global list() is called; if the latter fails, the error path frees opinfo while it remains linked, leading concurrent readers to dereference the freed node. Second, a NULL dereference occurs because opinfo->o fp is assigned after add lease global list() publishes opinfo on the global lease list, allowing find same lease key() to dereference opinfo->o fp->f ci while o fp is still NULL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31444

Affected Products

Linux Kernel

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-31444 · Security Note
• https://twitter.com/infoflowcloud/status/2046982039635644626 · Twitter Post
• https://git.kernel.org/stable/c/9e785f004cbc56390479b77375726ea9b0d1a8a6 · Note
• https://git.kernel.org/stable/c/7de55bba69cbf0f9280daaea385daf08bc076121 · Note
• https://git.kernel.org/stable/c/48623ec358c1c600fa1e38368746f933e0f1a617 · Note
• https://twitter.com/CVEnew/status/2046980048234684818 · Twitter Post
• https://git.kernel.org/stable/c/a5c6f6d6ceefed2d5210ee420fb75f8362461f46 · Note
• https://git.kernel.org/stable/c/6d7e5a918c1d0aad06db0e17677b66fc9a471021 · Note