CVE-2026-90155: ksmbd: detach blocked lock requests before freeing
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: detach blocked lock requests before freeing
A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flcblockedrequests. The ksmbdfile reference count does not cover that graph.
Both ksmbdclosefd() and the cross-request unlock path free these retained filelock objects directly. If a dependent waiter is still attached, locksreleaseprivate() hits BUGON(!listempty(&flc->flcblockedrequests)). The same lifetime mismatch can leave a freed ksmbdlock reachable through its request-local llist.
Detach the filelock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locksdeleteblock() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbdlock no longer points into the submitting worker's stack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
Detach each retained file_lock from the VFS blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths; ensure dependent waiters are also handled so locks_release_private() does not encounter a non-empty flc_blocked_requests list.
- Compensating control
Remove the request-local llist entry when a completed lock is published so a globally visible ksmbd_lock cannot retain a pointer into the submitting worker's stack or a freed request-local object.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's ksmbd SMB server are exposed when ksmbd retains byte-range lock state and blocked VFS lock requests can be chained beneath it. The affected paths include file-descriptor close, cross-request unlock, and lock rollback.
What conditions are needed to trigger the failure?
A dependent lock waiter must remain attached in the VFS blocked-request graph when ksmbd frees a retained file_lock. This can cause a BUG_ON when the lock is released and can also leave a freed ksmbd_lock reachable through a request-local list.
What does the fix change?
The fix detaches retained file_lock objects from the blocked-request graph before freeing them, including close, cross-request unlock, and rollback handling. It also removes completed published locks from the request-local list so globally visible lock state does not reference a submitting worker's stack.