GHSA-PGH2-G34P-4J6M

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: track the connection owning a byte-range lock

SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock.

With SMB3 multichannel, the connection handling the LOCK request can be different from the connection which opened the file. The entry can therefore be removed under a different spinlock from the one protecting the list it belongs to. A concurrent traversal can then access freed struct ksmbd_lock and struct file_lock objects.

Record the connection owning each lock's clist entry and hold a reference to it while the entry is linked. Use that connection and its llist_lock for unlock, rollback, close, and durable preserve. Durable reconnect assigns the new connection as the owner when publishing the locks again.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-64390"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:22Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: track the connection owning a byte-range lock\n\nSMB2_LOCK adds each granted byte-range lock to both the file lock list\nand the lock list of the connection which handled the request.  The\nfinal close and durable handle paths, however, remove the connection\nlist entry while holding fp-\u003econn-\u003ellist_lock.\n\nWith SMB3 multichannel, the connection handling the LOCK request can be\ndifferent from the connection which opened the file.  The entry can\ntherefore be removed under a different spinlock from the one protecting\nthe list it belongs to.  A concurrent traversal can then access freed\nstruct ksmbd_lock and struct file_lock objects.\n\nRecord the connection owning each lock\u0027s clist entry and hold a\nreference to it while the entry is linked.  Use that connection and its\nllist_lock for unlock, rollback, close, and durable preserve.  Durable\nreconnect assigns the new connection as the owner when publishing the\nlocks again.",
  "id": "GHSA-pgh2-g34p-4j6m",
  "modified": "2026-07-25T12:31:33Z",
  "published": "2026-07-25T12:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64390"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/22d38cf75b556c20b039743bdf3654d535b858be"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/427faaa52b0b399940c1a88065a5c310d10dad15"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5fecc15a30cb9ebd310f7b52c1ab607edcea78f6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/66eb3643164e5e1029907793926c132f8b5c6148"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ea5c9bf99f626a15cc59f645dc895f2b3f01992e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fe20d492a69a6f79e637f438072b212e21ed3b78"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.