9.8
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
When a durable file handle survives session disconnect (TCP close without
SMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the
handle for later reconnection. However, it did not clean up the byte-range
locks on fp->lock_list.
Later, when the durable scavenger thread times out and calls
__ksmbd_close_fd(NULL, fp), the lock cleanup loop did:
spin_lock(&fp->conn->llist_lock);
This caused a slab use-after-free because fp->conn was NULL and the
original connection object had already been freed by
ksmbd_tcp_disconnect().
The root cause is asymmetric cleanup: lock entries (smb_lock->clist) were
left dangling on the freed conn->lock_list while fp->conn was nulled out.
To fix this issue properly, we need to handle the lifetime of
smb_lock->clist across three paths:
- Safely skip clist deletion when list is empty and fp->conn is NULL.
- Remove the lock from the old connection's lock_list in
session_fd_check()
- Re-add the lock to the new connection's lock_list in
ksmbd_reopen_durable_fd().
ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
When a durable file handle survives session disconnect (TCP close without
SMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the
handle for later reconnection. However, it did not clean up the byte-range
locks on fp->lock_list.
Later, when the durable scavenger thread times out and calls
__ksmbd_close_fd(NULL, fp), the lock cleanup loop did:
spin_lock(&fp->conn->llist_lock);
This caused a slab use-after-free because fp->conn was NULL and the
original connection object had already been freed by
ksmbd_tcp_disconnect().
The root cause is asymmetric cleanup: lock entries (smb_lock->clist) were
left dangling on the freed conn->lock_list while fp->conn was nulled out.
To fix this issue properly, we need to handle the lifetime of
smb_lock->clist across three paths:
- Safely skip clist deletion when list is empty and fp->conn is NULL.
- Remove the lock from the old connection's lock_list in
session_fd_check()
- Re-add the lock to the new connection's lock_list in
ksmbd_reopen_durable_fd().
AI Analysis
Use-after-free vulnerability in ksmbd via durable scavenger
Basic Information
ID
CVE-2026-31718
Source
Linux
Published
May 1, 2026 at 13:56
Modified
May 3, 2026 at 05:45
Affected Product
Vendor
Linux
Product
Linux
Version
c8efcc786146a951091588e5fa7e3c754850cb3c
Affected Versions
Linux Linux c8efcc786146a951091588e5fa7e3c754850cb3c
Linux Linux c8efcc786146a951091588e5fa7e3c754850cb3c
Linux Linux c8efcc786146a951091588e5fa7e3c754850cb3c
Linux Linux c8efcc786146a951091588e5fa7e3c754850cb3c
Linux Linux 8df4bcdb0a4232192b2445256c39b787d58ef14d
Linux Linux 6.9
Linux Linux c8efcc786146a951091588e5fa7e3c754850cb3c
Linux Linux c8efcc786146a951091588e5fa7e3c754850cb3c
Linux Linux c8efcc786146a951091588e5fa7e3c754850cb3c
Linux Linux 8df4bcdb0a4232192b2445256c39b787d58ef14d
Linux Linux 6.9
AI Assessment
AI Score
9.8 / 10
AI Severity
Critical
Vendor
Linux
Product
ksmbd
Version
c8efcc786146a951091588e5fa7e3c754850cb3c