CVE-2026-90156: ksmbd: safely discard unregistered deferred locks
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: safely discard unregistered deferred locks
When vfslockfile() defers a lock, smb2lock() puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smblock->conn is initialized and dereferences NULL. The deferred filelock also remains linked into the VFS blocked-lock state while it is freed.
Keep the lock off rollbacklist until async setup succeeds. On setup failures, explicitly unblock and wake the deferred lock before freeing it and its ksmbd wrapper.
Event History
Frequently Asked Questions
What sequence is required to reach the faulty cleanup path?
vfs_lock_file() must defer a lock during smb2_lock(), after which allocation or registration of the asynchronous work must fail. The lock has already been placed on rollback_list before that async setup completes.
What can go wrong when asynchronous lock setup fails?
Rollback can dereference smb_lock->conn while it is NULL. The deferred file_lock can also be freed while still linked in the VFS blocked-lock state.