CVE-2026-90155: ksmbd: detach blocked lock requests before freeing
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: detach blocked lock requests before freeing
A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flcblockedrequests. The ksmbdfile reference count does not cover that graph.
Both ksmbdclosefd() and the cross-request unlock path free these retained filelock objects directly. If a dependent waiter is still attached, locksreleaseprivate() hits BUGON(!listempty(&flc->flcblockedrequests)). The same lifetime mismatch can leave a freed ksmbdlock reachable through its request-local llist.
Detach the filelock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locksdeleteblock() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbdlock no longer points into the submitting worker's stack.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's ksmbd SMB server are exposed when ksmbd retains byte-range lock state and blocked VFS lock requests can be chained beneath it. The affected paths include file-descriptor close, cross-request unlock, and lock rollback.
What conditions are needed to trigger the failure?
A dependent lock waiter must remain attached in the VFS blocked-request graph when ksmbd frees a retained file_lock. This can cause a BUG_ON when the lock is released and can also leave a freed ksmbd_lock reachable through a request-local list.
What does the fix change?
The fix detaches retained file_lock objects from the blocked-request graph before freeing them, including close, cross-request unlock, and rollback handling. It also removes completed published locks from the request-local list so globally visible lock state does not reference a submitting worker's stack.