In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
When a durable file handle survives session disconnect (TCP close without
SMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the
handle for later reconnection. However, it did not clean up the byte-range
locks on fp->lock_list.
Later, when the durable scavenger thread times out and calls
__ksmbd_close_fd(NULL, fp), the lock cleanup loop did:
spin_lock(&fp->conn->llist_lock);
This caused a slab use-after-free because fp->conn was NULL and the
original connection object had already been freed by
ksmbd_tcp_disconnect().
The root cause is asymmetric cleanup: lock entries (smb_lock->clist) were
left dangling on the freed conn->lock_list while fp->conn was nulled out.
To fix this issue properly, we need to handle the lifetime of
smb_lock->clist across three paths:
- Safely skip clist deletion when list is empty and fp->conn is NULL.
- Remove the lock from the old connection's lock_list in
session_fd_check()
- Re-add the lock to the new connection's lock_list in
ksmbd_reopen_durable_fd().
References
Configurations
Configuration 1 (hide)
|
History
17 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 May 2026, 21:07
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
|
| CWE | CWE-416 | |
| References | () https://git.kernel.org/stable/c/235e32320a470fcd3998fb3774f2290a0eb302a1 - Patch | |
| References | () https://git.kernel.org/stable/c/3d6682726c2d3a46d31dae88b8166786b09b03ad - Patch | |
| References | () https://git.kernel.org/stable/c/b34fc42cfe922e551f7a27d3ac3bb016e41d7dd9 - Patch | |
| References | () https://git.kernel.org/stable/c/e33c65f011980b4ad4abfd93585ec2079856368f - Patch |
03 May 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
01 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-01 14:16
Updated : 2026-05-17 16:16
NVD link : CVE-2026-31718
Mitre link : CVE-2026-31718
CVE.ORG link : CVE-2026-31718
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free