CVE-2026-90162

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer publishing granted locks to prevent UAF/double-free race

In smb2_lock(), mid-batch granted locks are published to connection-wide

(conn->lock_list) and file-wide (fp->lock_list) lists immediately upon

vfs_lock_file() success, while also remaining tracked on the stack-local

rollback_list.

If a subsequent element in the same SMB2_LOCK request array fails

validation or execution, the thread jumps to out: and walks

rollback_list to undo previously granted locks. However, because the

granted lock was already published to conn->lock_list, a concurrent

UNLOCK request on the same connection can find the lock object and

kfree() it before the rollback loop executes.

When the granting thread subsequently walks rollback_list, it

dereferences and frees the already-freed ksmbd_lock structure, resulting

in a Use-After-Free and Double-Free (on both ksmbd_lock and struct

file_lock).

Fix this by deferring the publicati

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References