CVE-2026-45924: ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths

Q: What conditions are needed to trigger this issue?

The issue occurs on ksmbd error paths after ksmbd_vfs_kern_path_start_removing() has succeeded, when the matching cleanup function is not called. Exploitation requires local access with low privileges; no user interaction is required.

Q: What is the practical impact if the vulnerable path is reached?

The missing cleanup can leave inode locks and references held, creating potential deadlocks and unbalanced locks. The reported symptom includes a workqueue worker leaking locks while processing ksmbd work.

Q: How can I tell whether this issue is occurring?

Look for kernel warnings reporting a workqueue leaked lock or atomic condition in a ksmbd-io worker, with handle_ksmbd_work in the workqueue context. Reports may also show locks held from ksmbd_vfs_kern_path_locked.

Q: What should be done to remediate it?

Apply a kernel update containing the fix referenced by the listed stable kernel commits. The fix adds the missing ksmbd_vfs_kern_path_end_removing() calls on the affected error paths.

Published May 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: call ksmbdvfskernpathendremoving() on some error paths

There are two places where ksmbdvfskernpathendremoving() needs to be called in order to balance what the corresponding successful call to ksmbdvfskernpathstartremoving() has done, i.e. drop inode locks and put the taken references. Otherwise there might be potential deadlocks and unbalanced locks which are caught like:

BUG: workqueue leaked lock or atomic: kworker/5:21/0x00000000/7596 last function: handleksmbdwork 2 locks held by kworker/5:21/7596: #0: ffff8881051ae448 (sbwriters#3){.+.+}-{0:0}, at: ksmbdvfskernpathlocked+0x142/0x660 #1: ffff888130e966c0 (&type->imutexdirkey#3/1){+.+.}-{4:4}, at: ksmbdvfskernpathlocked+0x17d/0x660 CPU: 5 PID: 7596 Comm: kworker/5:21 Not tainted 6.1.162-00456-gc29b353f383b #138 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: ksmbd-io handleksmbdwork Call Trace: <TASK> dumpstacklvl+0x44/0x5b processonework.cold+0x57/0x5c workerthread+0x82/0x600 kthread+0x153/0x190 retfromfork+0x22/0x30 </TASK>

Found by Linux Verification Center (linuxtesting.org).

Affected Software

8 affected components

Linux Linux kernel

Linux Linux kernel>=5.15.190<5.15.203

Linux Linux kernel>=6.1.149<6.1.167

Linux Linux kernel>=6.6.103<6.6.130

Linux Linux kernel>=6.12.43<6.12.78

Linux Linux kernel>=6.15.11<6.16

Linux Linux kernel>=6.16.2<6.18.17

Linux Linux kernel>=6.19<6.19.4

Event History

May 27, 2026

CVE Published

via MITRE·12:17 PM

Data Sourced

via MITRE·12:17 PM

Description

Data Sourced

via NVD·02:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What conditions are needed to trigger this issue?

The issue occurs on ksmbd error paths after ksmbd_vfs_kern_path_start_removing() has succeeded, when the matching cleanup function is not called. Exploitation requires local access with low privileges; no user interaction is required.

What is the practical impact if the vulnerable path is reached?

The missing cleanup can leave inode locks and references held, creating potential deadlocks and unbalanced locks. The reported symptom includes a workqueue worker leaking locks while processing ksmbd work.

How can I tell whether this issue is occurring?

Look for kernel warnings reporting a workqueue leaked lock or atomic condition in a ksmbd-io worker, with handle_ksmbd_work in the workqueue context. Reports may also show locks held from ksmbd_vfs_kern_path_locked.

What should be done to remediate it?

Apply a kernel update containing the fix referenced by the listed stable kernel commits. The fix adds the missing ksmbd_vfs_kern_path_end_removing() calls on the affected error paths.

CVE-2026-45924: ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths

Affected Software

Event History

Frequently Asked Questions

What conditions are needed to trigger this issue?

What is the practical impact if the vulnerable path is reached?

How can I tell whether this issue is occurring?

What should be done to remediate it?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger this issue?

What is the practical impact if the vulnerable path is reached?

How can I tell whether this issue is occurring?

What should be done to remediate it?