CVE-2026-64396

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

When a blocking byte-range lock request is deferred in the

FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into

the connection's async_requests list via setup_async_work(). The cancel

callback smb2_remove_blocked_lock() holds a reference to the flock.

If the lock waiter is subsequently woken up but the work state is no

longer KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the

cleanup path calls locks_free_lock(flock) without dequeuing the work from

the async_requests list. Concurrently, smb2_cancel() walks the list

under conn->request_lock and invokes the cancel callback, which then

dereferences the already freed 'flock'. This leads to a slab-use-after-free

inside __wake_up_common.

Fix this by restructuring the cleanup logic after the worker returns

from ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock->llist)

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References