CVE-2026-53198

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL

A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on

conn->async_requests via setup_async_work(), with cancel_fn =

smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.

When the request is cancelled, the worker frees the file_lock with

locks_free_lock() and takes the cancelled early-exit, which "goto out"s and never

reaches release_async_work() -- the only site that unlinks the work from

conn->async_requests and clears cancel_fn/cancel_argv. The work therefore stays

matchable on async_requests with a live cancel_fn pointing at the freed file_lock,

until connection teardown finally runs release_async_work().

smb2_cancel() fires cancel_fn unconditionally with no state guard, so a second

SMB2_CANCEL for the same AsyncId, arriving in that window, re-runs

smb2_remove_blocked_lock() on the freed fil

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References