CVE-2026-64437: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free of a deferred filelock on SMB2CLOSE then SMB2CANCEL

Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL") made smb2cancel() skip a work whose state is KSMBDWORKCANCELLED, so its cancelfn cannot be fired a second time. But KSMBDWORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too:

SMB2CLOSE on the locking handle -> setclosestateblockedworks() sets the deferred work's state to KSMBDWORKCLOSED and wakes the smb2lock() worker. The worker takes the non-ACTIVE early-exit, locksfreelock()s the filelock and, because the state is not KSMBDWORKCANCELLED, takes the STATUSRANGENOTLOCKED branch with "goto out2" -- which, like the cancelled branch, skips releaseasyncwork(). The work stays on conn->asyncrequests with a live cancelfn = smb2removeblockedlock pointing at the freed filelock.

A subsequent SMB2CANCEL for the same AsyncId then passes the KSMBDWORKCANCELLED-only guard (its state is KSMBDWORKCLOSED), so smb2cancel() fires cancelfn again over the freed filelock -- the same use-after-free fixed, via SMB2CLOSE instead of a first SMB2CANCEL:

BUG: KASAN: slab-use-after-free in locksdeleteblock locksdeleteblock locksdeleteblock ksmbdvfsposixlockunblock smb2removeblockedlock smb2cancel <- 2nd SMB2CANCEL fires cancelfn handleksmbdwork Allocated by ...: locksalloclock <- smb2lock Freed by ...: locksfreelock <- smb2lock (non-ACTIVE early-exit) ... cache filelockcache of size 192

Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger.

Only an ACTIVE deferred work may have its cancelfn fired: both terminal states (CANCELLED and CLOSED) reach the smb2lock() early-exit that frees the filelock and skips releaseasyncwork(). Guard on KSMBDWORKACTIVE so any non-active work is skipped.