HIGH Introduced in 5.15
ksmbd DeferredLock UAF
CVE-2026-90156
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on rollback_list before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smb_lock->conn is initialized and dereferences NULL. The deferred file_lock also remains linked into the VFS blocked-lock state while it is freed. Keep the lock off rollback_list until async setup succeeds. On setup failures, explicitly unblock and wake the deferred lock before freeing it and its ksmbd wrapper.
02KernelScan AI Analysis
Risk summary
A network-accessible NULL pointer dereference and use-after-free in the ksmbd SMB server's lock handling. Any SMB client that can connect to the server and send a conflicting lock request can trigger a kernel panic or potentially exploit heap corruption. Systems exposing ksmbd to untrusted networks are at serious risk.
Vulnerability analysis
The server's handling of deferred file locks is unsafe. When a client requests a lock that must wait because another lock blocks it, the server places the lock on an internal cleanup list before the background task needed to manage it is successfully created. If that setup fails, the error path dereferences a null pointer, crashing the kernel. In addition, the lock structure is freed while the kernel's file-locking framework still holds a reference to it, creating a use-after-free. The fix waits until the background task is ready before making the lock eligible for cleanup, and if setup fails, it properly removes the lock from the kernel's deferred state before releasing the memory. Any SMB client that can connect to the server and issue a conflicting lock request can trigger this flaw.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 5.15 | 7.3-rc1 | 054bcca4cd9f |
| 7.2 | 5.15 | 7.2.6 | d09af9a35ff7 |