PT-2026-64617 · Linux · Linux
CVE-2026-64396
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix UAF of struct file lock in SMB2 LOCK deferred-lock cancellation
When a blocking byte-range lock request is deferred in the
FILE LOCK DEFERRED path, ksmbd registers the asynchronous work into
the connection's async requests list via setup async work(). The cancel
callback smb2 remove blocked lock() holds a reference to the flock.
If the lock waiter is subsequently woken up but the work state is no
longer KSMBD WORK ACTIVE (e.g., due to a concurrent cancellation), the
cleanup path calls locks free lock(flock) without dequeuing the work from
the async requests list. Concurrently, smb2 cancel() walks the list
under conn->request lock and invokes the cancel callback, which then
dereferences the already freed 'flock'. This leads to a slab-use-after-free
inside wake up common.
Fix this by restructuring the cleanup logic after the worker returns
from ksmbd vfs posix lock wait(). Move list del(&smb lock->llist) and
release async work(work) to the top of the cleanup block. This guarantees
that the async work is completely dequeued and serialized under
conn->request lock before locks free lock(flock) is called, rendering
the flock unreachable for any concurrent smb2 cancel().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux