CVE-2026-53198
published 2026-06-25CVE-2026-53198: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred…
PriorityP350high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.47%
37.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on
conn->async_requests via setup_async_work(), with cancel_fn =
smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.
When the request is cancelled, the worker frees the file_lock with
locks_free_lock() and takes the cancelled early-exit, which "goto out"s and never
reaches release_async_work() -- the only site that unlinks the work from
conn->async_requests and clears cancel_fn/cancel_argv. The work therefore stays
matchable on async_requests with a live cancel_fn pointing at the freed file_lock,
until connection teardown finally runs release_async_work().
smb2_cancel() fires cancel_fn unconditionally with no state guard, so a second
SMB2_CANCEL for the same AsyncId, arriving in that window, re-runs
smb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free:
BUG: KASAN: slab-use-after-free in __locks_delete_block
__locks_delete_block
locks_delete_block
ksmbd_vfs_posix_lock_unblock
smb2_remove_blocked_lock
smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn
handle_ksmbd_work
Allocated by ...: locks_alloc_lock <- smb2_lock
Freed by ...: locks_free_lock <- smb2_lock (cancelled branch)
... cache file_lock_cache of size 192
Reproduced on mainline with KASAN by an authenticated SMB client.
Skip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback
cannot be fired a second time.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < b7063c7426ea5a4d15e01b60538718765392f49d | b7063c7426ea5a4d15e01b60538718765392f49d |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd | 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147 | 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147 |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 14d2eee0193ac3cd1bf3d014373449f0b8d35d6d | 14d2eee0193ac3cd1bf3d014373449f0b8d35d6d |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694 | 2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694 |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < f580d27e8928828693df44ba2db0fffdbe11dfea | f580d27e8928828693df44ba2db0fffdbe11dfea |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.15 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock (an SMB2_LOCK that blocks) regi
ghsa_unreviewed·2026-06-25
CVE-2026-53198 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock (an SMB2_LOCK that blocks) regi
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on
conn->async_requests via setup_async_work(), with cancel_fn =
smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.
When the request is cancelled, the worker frees the file_lock with
locks_free_lock() and takes the cancelled early-exit, which "goto out"s and never
reaches release_async_work() -- the only site that unlinks the work from
conn->async_requests and clears cancel_fn/cancel_argv. The work therefore stays
matchable on async_requests with a live cancel_fn pointing at the freed file_lock,
until connection teardown finally runs release_asyn
Red Hat
kernel: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
vendor_redhat·2026-06-25
CVE-2026-53198 CWE-1341 kernel: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
kernel: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB server. An authenticated SMB client can trigger a use-after-free vulnerability by sending a double SMB2_CANCEL request for the same asynchronous operation. This can lead to memory corruption, potentially allowing an attacker to cause a denial of service or execute arbitrary code.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0da2e073f9cbf4985a0fd9acb71bc5ff599f8afdhttps://git.kernel.org/stable/c/14d2eee0193ac3cd1bf3d014373449f0b8d35d6dhttps://git.kernel.org/stable/c/2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694https://git.kernel.org/stable/c/89ae9df09d2c1fb4a4eb495c113a7ce1dca34147https://git.kernel.org/stable/c/b7063c7426ea5a4d15e01b60538718765392f49dhttps://git.kernel.org/stable/c/f580d27e8928828693df44ba2db0fffdbe11dfea
2026-06-25
Published