CVE-2026-31477

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix memory leaks and NULL deref in smb2_lock()

smb2_lock() has three error handling issues after list_del() detaches

smb_lock from lock_list at no_check_cl:

1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK

path, goto out leaks smb_lock and its flock because the out:

handler only iterates lock_list and rollback_list, neither of

which contains the detached smb_lock.

2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out

leaks smb_lock and flock for the same reason. The error code

returned to the dispatcher is also stale.

3) In the rollback path, smb_flock_init() can return NULL on

allocation failure. The result is dereferenced unconditionally,

causing a kernel NULL pointer dereference. Add a NULL check to

prevent the crash and clean up the bookkeeping; the VFS lock

itself cannot be rolled back without the allocation and will be

released at file o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References