CVE-2026-90162 (GCVE-0-2026-90162)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53
VLAI
Title
ksmbd: defer publishing granted locks to prevent UAF/double-free race
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid-batch granted locks are published to connection-wide (conn->lock_list) and file-wide (fp->lock_list) lists immediately upon vfs_lock_file() success, while also remaining tracked on the stack-local rollback_list. If a subsequent element in the same SMB2_LOCK request array fails validation or execution, the thread jumps to out: and walks rollback_list to undo previously granted locks. However, because the granted lock was already published to conn->lock_list, a concurrent UNLOCK request on the same connection can find the lock object and kfree() it before the rollback loop executes. When the granting thread subsequently walks rollback_list, it dereferences and frees the already-freed ksmbd_lock structure, resulting in a Use-After-Free and Double-Free (on both ksmbd_lock and struct file_lock). Fix this by deferring the publication of granted locks to conn->lock_list and fp->lock_list until after the entire array of lock elements has been processed without error. Mid-batch grants remain tracked exclusively on the request-local rollback_list until the whole batch succeeds, eliminating the race window.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < a1d26dfb32919088e3638dca01068df3c4507433 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 29f74f0f2e6df3b393b7b66e810136d0c64e3c59 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a1d26dfb32919088e3638dca01068df3c4507433",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "29f74f0f2e6df3b393b7b66e810136d0c64e3c59",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: defer publishing granted locks to prevent UAF/double-free race\n\nIn smb2_lock(), mid-batch granted locks are published to connection-wide\n(conn-\u003elock_list) and file-wide (fp-\u003elock_list) lists immediately upon\nvfs_lock_file() success, while also remaining tracked on the stack-local\nrollback_list.\n\nIf a subsequent element in the same SMB2_LOCK request array fails\nvalidation or execution, the thread jumps to out: and walks\nrollback_list to undo previously granted locks. However, because the\ngranted lock was already published to conn-\u003elock_list, a concurrent\nUNLOCK request on the same connection can find the lock object and\nkfree() it before the rollback loop executes.\n\nWhen the granting thread subsequently walks rollback_list, it\ndereferences and frees the already-freed ksmbd_lock structure, resulting\nin a Use-After-Free and Double-Free (on both ksmbd_lock and struct\nfile_lock).\n\nFix this by deferring the publication of granted locks to\nconn-\u003elock_list and fp-\u003elock_list until after the entire array of lock\nelements has been processed without error. Mid-batch grants remain\ntracked exclusively on the request-local rollback_list until the whole\nbatch succeeds, eliminating the race window."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The attacker-controlled data is the SMB2 LOCK request (struct smb2_lock_req lock elements: Offset, Length, Flags) received on TCP/445 by ksmbd_conn_handler_loop(), queued with queue_ksmbd_work(), and dispatched to smb2_lock() via conn-\u003ecmds[SMB2_LOCK_HE]; the racing free is a second SMB2 LOCK with SMB2_LOCKFLAG_UNLOCK on the same FID.\nAC:L - The attacker drives both sides: smb2_lock() publishes a granted ksmbd_lock onto conn-\u003elock_list after vfs_lock_file() succeeds for lock element 0, then a later element in the same LockCount\u003e1 array fails (cmd\u003c0, missing SMB2_LOCKFLAG_MASK, or overlap) and walks rollback_list, while a concurrent SMB2 LOCK UNLOCK on ksmbd-io (WQ_PERCPU) kfree()s that object; the race is retryable.\nPR:L - SMB2_LOCK is not in the smb2_check_user_session() pre-auth skip list (only NEGOTIATE/SESSION_SETUP/ECHO); it requires SMB2_SESSION_VALID, smb2_get_ksmbd_tcon() for a tree id, and ksmbd_lookup_fd_slow() after smb2_open(). An ordinary authenticated share user suffices; this is not a pre-auth handshake.\nUI:N - The attacker completes SESSION_SETUP, TREE_CONNECT and CREATE on their own ksmbd TCP connection, then sends the multi-element SMB2 LOCK and concurrent UNLOCK; no victim mount, click, or administrator action is required.\nS:U - The UAF and double-free of ksmbd_lock and struct file_lock occur in the ksmbd-io worker on the host that accepted the SMB session and do not cross a VM, guest-to-host, or IOMMU/DMA boundary.\nC:H - UNLOCK\u0027s kfree(cmp_lock) leaves rollback reading smb_lock-\u003estart, smb_lock-\u003eend, smb_lock-\u003econn and smb_lock-\u003efl from a freed ksmbd_lock; reclaiming that slab or the associated file_lock_cache object with attacker-controlled contents yields an arbitrary kernel read.\nI:H - The same rollback path list_del()s smb_lock-\u003eflist and smb_lock-\u003eclist on the freed object, then locks_free_lock(smb_lock-\u003efl) and kfree(smb_lock) after UNLOCK already freed both, giving a double-free and list_del write primitive for heap corruption and control-flow hijack.\nA:H - Dereferencing the freed ksmbd_lock (including spin_lock on smb_lock-\u003econn-\u003ellist_lock) and double-freeing ksmbd_lock/file_lock oops or panic the ksmbd-io worker; the LOCK/UNLOCK pair can be repeated to crash the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:30.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a1d26dfb32919088e3638dca01068df3c4507433"
        },
        {
          "url": "https://git.kernel.org/stable/c/29f74f0f2e6df3b393b7b66e810136d0c64e3c59"
        }
      ],
      "title": "ksmbd: defer publishing granted locks to prevent UAF/double-free race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90162",
    "datePublished": "2026-09-17T16:06:53.136Z",
    "dateReserved": "2026-09-11T19:38:34.790Z",
    "dateUpdated": "2026-09-18T17:53:30.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90162",
      "date": "2026-09-25",
      "epss": "0.00616",
      "percentile": "0.47307"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:12:02.000Z",
      "cve": "CVE-2026-90162",
      "id": "msrc_CVE-2026-90162",
      "initial_release_date": "2026-09-19T01:04:09.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: defer publishing granted locks to prevent UAF/double-free race",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90162.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a1d26dfb32919088e3638dca01068df3c4507433",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "29f74f0f2e6df3b393b7b66e810136d0c64e3c59",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: defer publishing granted locks to prevent UAF/double-free race\n\nIn smb2_lock(), mid-batch granted locks are published to connection-wide\n(conn-\u003elock_list) and file-wide (fp-\u003elock_list) lists immediately upon\nvfs_lock_file() success, while also remaining tracked on the stack-local\nrollback_list.\n\nIf a subsequent element in the same SMB2_LOCK request array fails\nvalidation or execution, the thread jumps to out: and walks\nrollback_list to undo previously granted locks. However, because the\ngranted lock was already published to conn-\u003elock_list, a concurrent\nUNLOCK request on the same connection can find the lock object and\nkfree() it before the rollback loop executes.\n\nWhen the granting thread subsequently walks rollback_list, it\ndereferences and frees the already-freed ksmbd_lock structure, resulting\nin a Use-After-Free and Double-Free (on both ksmbd_lock and struct\nfile_lock).\n\nFix this by deferring the publication of granted locks to\nconn-\u003elock_list and fp-\u003elock_list until after the entire array of lock\nelements has been processed without error. Mid-batch grants remain\ntracked exclusively on the request-local rollback_list until the whole\nbatch succeeds, eliminating the race window."
          }
        ],
        "id": "CVE-2026-90162",
        "lastModified": "2026-09-18T18:17:44.827",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:09.517",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/29f74f0f2e6df3b393b7b66e810136d0c64e3c59"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a1d26dfb32919088e3638dca01068df3c4507433"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.