In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
smb_grant_oplock() has two issues in the oplock publication sequence:
1) opinfo is linked into ci->m_op_list (via opinfo_add) before
add_lease_global_list() is called. If add_lease_global_list()
fails (kmalloc returns NULL), the error path frees the opinfo
via __free_opinfo() while it is still linked in ci->m_op_list.
Concurrent m_op_list readers (opinfo_get_list, or direct iteration
in smb_break_all_levII_oplock) dereference the freed node.
2) opinfo->o_fp is assigned after add_lease_global_list() publishes
the opinfo on the global lease list. A concurrent
find_same_lease_key() can walk the lease list and dereference
opinfo->o_fp->f_ci while o_fp is still NULL.
Fix by restructuring the publication sequence to eliminate post-publish
failure:
- Set opinfo->o_fp before any list publication (fixes NULL deref).
- Preallocate lease_table via alloc_lease_table() before opinfo_add()
so add_lease_global_list() becomes infallible after publication.
- Keep the original m_op_list publication order (opinfo_add before
lease list) so concurrent opens via same_client_has_lease() and
opinfo_get_list() still see the in-flight grant.
- Use opinfo_put() instead of __free_opinfo() on err_out so that
the RCU-deferred free path is used.
This also requires splitting add_lease_global_list() to take a
preallocated lease_table and changing its return type from int to void,
since it can no longer fail.
References
Configurations
Configuration 1 (hide)
|
History
07 May 2026, 19:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/48623ec358c1c600fa1e38368746f933e0f1a617 - Patch | |
| References | () https://git.kernel.org/stable/c/6d7e5a918c1d0aad06db0e17677b66fc9a471021 - Patch | |
| References | () https://git.kernel.org/stable/c/7de55bba69cbf0f9280daaea385daf08bc076121 - Patch | |
| References | () https://git.kernel.org/stable/c/9e785f004cbc56390479b77375726ea9b0d1a8a6 - Patch | |
| References | () https://git.kernel.org/stable/c/a5c6f6d6ceefed2d5210ee420fb75f8362461f46 - Patch | |
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-416 | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.6.130:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-05-07 19:26
NVD link : CVE-2026-31444
Mitre link : CVE-2026-31444
CVE.ORG link : CVE-2026-31444
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free