{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\\n\\nA deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on\\nconn-\\u003easync_requests via setup_async_work(), with cancel_fn =\\nsmb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.\\n\\nWhen the request is cancelled, the worker frees the file_lock with\\nlocks_free_lock() and takes the cancelled early-exit, which \\”goto out\\”s and never\\nreaches release_async_work() — the only site that unlinks the work from\\nconn-\\u003easync_requests and clears cancel_fn\/cancel_argv. The work therefore stays\\nmatchable on async_requests with a live cancel_fn pointing at the freed file_lock,\\nuntil connection teardown finally runs release_async_work().\\n\\nsmb2_cancel() fires cancel_fn unconditionally with no state guard, so a second\\nSMB2_CANCEL for the same AsyncId, arriving in that window, re-runs\\nsmb2_remove_blocked_lock() on the freed file_lock — a slab use-after-free:\\n\\n BUG: KASAN: slab-use-after-free in __locks_delete_block\\n __locks_delete_block\\n locks_delete_block\\n ksmbd_vfs_posix_lock_unblock\\n smb2_remove_blocked_lock\\n smb2_cancel \\u003c- 2nd SMB2_CANCEL fires cancel_fn\\n handle_ksmbd_work\\n Allocated by …: locks_alloc_lock \\u003c- smb2_lock\\n Freed by …: locks_free_lock \\u003c- smb2_lock (cancelled branch)\\n … cache file_lock_cache of size 192\\n\\nReproduced on mainline with KASAN by an authenticated SMB client.\\n\\nSkip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback\\ncannot be fired a second time.”,”published”:”2026-06-25T08:39:07.650Z”,”modified”:”2026-06-28T06:40:15.304Z”,”type”:”cve”,”title”:”ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/b7063c7426ea5a4d15e01b60538718765392f49d\\nhttps:\/\/git.kernel.org\/stable\/c\/0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd\\nhttps:\/\/git.kernel.org\/stable\/c\/89ae9df09d2c1fb4a4eb495c113a7ce1dca34147\\nhttps:\/\/git.kernel.org\/stable\/c\/14d2eee0193ac3cd1bf3d014373449f0b8d35d6d\\nhttps:\/\/git.kernel.org\/stable\/c\/2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694\\nhttps:\/\/git.kernel.org\/stable\/c\/f580d27e8928828693df44ba2db0fffdbe11dfea”,”id”:”CVE-2026-53198″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 0\\nLinux Linux 0\\nLinux Linux 0\\nLinux Linux 0\\nLinux Linux 0″,”sourceHref”:””,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”1da177e4c3f41524e886b7f1b8a0c1fc7321cac2″,”vendor”:”Linux”,”ai_description”:”AI processing failed – invalid JSON response”,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\\n\\nA deferred byte-range lock (an SMB2_LOCK that…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,41,12,15,13,7,11,5],"class_list":["post-66496","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n