CVE-2026-31444

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

smb_grant_oplock() has two issues in the oplock publication sequence:

1) opinfo is linked into ci->m_op_list (via opinfo_add) before

add_lease_global_list() is called. If add_lease_global_list()

fails (kmalloc returns NULL), the error path frees the opinfo

via __free_opinfo() while it is still linked in ci->m_op_list.

Concurrent m_op_list readers (opinfo_get_list, or direct iteration

in smb_break_all_levII_oplock) dereference the freed node.

2) opinfo->o_fp is assigned after add_lease_global_list() publishes

the opinfo on the global lease list. A concurrent

find_same_lease_key() can walk the lease list and dereference

opinfo->o_fp->f_ci while o_fp is still NULL.

Fix by restructuring the publication sequence to eliminate post-publish

failure:

- Set opinfo->o_fp before any list publication (fixes NULL deref).

- Preallocate leas

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References