PT-2026-34382 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31477

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The smb2 lock() function in the ksmbd module contains three error handling issues. First, if vfs lock file() returns an unexpected error in the non-UNLOCK path, the smb lock and its flock are leaked because the handler does not iterate over the detached smb lock. Second, a similar leak of smb lock and flock occurs if vfs lock file() returns -ENOENT in the UNLOCK path, and a stale error code is returned to the dispatcher. Third, in the rollback path, smb flock init() may return NULL during an allocation failure, which is then dereferenced unconditionally, leading to a kernel NULL pointer dereference (a situation where the system attempts to read or write to a memory address that is zero, typically causing a system crash).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31477

Affected Products

Linux Kernel

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-31477 · Security Note
• https://twitter.com/CVEnew/status/2046980005960282308 · Twitter Post
• https://git.kernel.org/stable/c/309b44ed684496ed3f9c5715d10b899338623512 · Note
• https://git.kernel.org/stable/c/91aeaa7256006d79a37298f5a1df23325db91599 · Note
• https://git.kernel.org/stable/c/aab42f0795620cf0d3955a520f571f697d0f9a2a · Note
• https://git.kernel.org/stable/c/cdac6f7e7e428dc70e3b5898ac6999a72ed13993 · Note
• https://git.kernel.org/stable/c/3cdacd11b41569ce75b3162142240f2355e04900 · Note
• https://git.kernel.org/stable/c/c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9 · Note