PT-2026-51890 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-52996
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
ksmbd lookup fd cguid() returns a ksmbd file with its refcount
incremented via ksmbd fp get(). parse durable handle context() in
the DURABLE REQ V2 case properly releases this reference on every
path inside the ClientGUID-match branch, either by calling
ksmbd put durable fd() or by transferring ownership to dh info->fp
for a successful reconnect. However, when an entry exists in the
global file table with the same CreateGuid but a different
ClientGUID, the code simply falls through to the new-open path
without dropping the reference obtained from ksmbd lookup fd cguid().
Per MS-SMB2 section 3.3.5.9.10 ("Handling the
SMB2 CREATE DURABLE HANDLE REQUEST V2 Create Context"), the server
MUST locate an Open whose Open.CreateGuid matches the request's
CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the
connection that received the request. If no such Open is found, the
server MUST continue with the normal open execution phase. A
CreateGuid hit with a ClientGUID mismatch is therefore the
"Open not found" case: proceeding with a new open is correct, but
the reference obtained purely as a side effect of the lookup must
not be leaked.
Repeated requests that hit this mismatch pin global ft entries,
prevent ksmbd close fd() from ever running for the corresponding
files, and defeat the durable scavenger, leading to long-lived
resource leaks.
Release the reference in the mismatch path and clear dh info->fp so
subsequent logic does not mistake a non-matching lookup result for
a reconnect target.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux