ksmbd SessionLogoff UAF

Vulnerability analysis

During SMB3 session logoff or previous-session destruction, the kernel SMB server could free shared session objects while requests were still running on other connections bound to the same session. The original teardown path only waited for the current connection to finish rather than all channels, and deferred file locks remained counted as active requests indefinitely because they only wake when a file closes, stalling the drain. State changes that were not atomic also allowed cancellation callbacks to fire multiple times on objects already being torn down. The fix marks a session as shutting down so teardown and new channel registration cannot overlap, waits for every bound channel to finish before freeing session objects, wakes blocked file locks during the drain without altering their underlying files, and uses atomic state transitions so logoff, cancel, and disconnect operations each invoke cancellation callbacks exactly once. An authenticated remote SMB client can reach this path by establishing a multichannel session and sending a logoff or session-setup with a previous-session identifier while concurrent requests are active on another channel.