In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer publishing granted locks to prevent UAF/double-free race

In smb2lock(), mid-batch granted locks are published to connection-wide (conn->locklist) and file-wide (fp->locklist) lists immediately upon vfslockfile() success, while also remaining tracked on the stack-local rollbacklist.

If a subsequent element in the same SMB2LOCK request array fails validation or execution, the thread jumps to out: and walks rollbacklist to undo previously granted locks. However, because the granted lock was already published to conn->locklist, a concurrent UNLOCK request on the same connection can find the lock object and kfree() it before the rollback loop executes.

When the granting thread subsequently walks rollbacklist, it dereferences and frees the already-freed ksmbdlock structure, resulting in a Use-After-Free and Double-Free (on both ksmbdlock and struct filelock).

Fix this by deferring the publication of granted locks to conn->locklist and fp->locklist until after the entire array of lock elements has been processed without error. Mid-batch grants remain tracked exclusively on the request-local rollbacklist until the whole batch succeeds, eliminating the race window.