CVE-2026-43379: ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in smblazyparentleasebreakclose()
opinfo pointer obtained via rcudereference(fp->fopinfo) is being accessed after rcureadunlock() has been called. This creates a race condition where the memory could be freed by a concurrent writer between the unlock and the subsequent pointer dereferences (opinfo->islease, etc.), leading to a use-after-free.
Affected Software
Event History
Frequently Asked Questions
What component must be in use for this issue to be relevant?
The affected component is ksmbd in the Linux kernel. Systems not using ksmbd are not indicated by the provided information as exposed to this flaw.
What conditions allow the use-after-free to occur?
The issue requires a race with a concurrent writer: an opinfo pointer is obtained under RCU protection, then accessed after the RCU read lock is released while another writer may free the associated memory. The provided data does not specify any authentication or user-interaction prerequisite.
How can I determine whether a system has the fix?
Check whether the installed kernel includes one of the referenced stable commits: bf4d66d72e4a9e268c1012c331ce9eaedb5e2086, 960699317d39f46611f4ebeb69edc567c1f4e6b6, or dbbd328cf58261ca239756fe1c0d10c9518d3399. The supplied information does not identify fixed kernel version numbers.