Read the docs
TI-2026-61205 Aliases CVE-2026-90162GHSA-x2qc-qfqc-6vmr

ksmbd: defer publishing granted locks to prevent UAF/double-free race

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid-batch granted locks are published to connection-wide (conn->lock_list) and file-wide (fp->lock_list) lists immediately upon vfs_lock_file() success, while also remaining tracked on the stack-local rollback_list. If a subsequent element in the same SMB2_LOCK request array fails validation or execution, the thread jumps to out: and walks rollback_list to undo previously granted locks. However, because the granted lock was already published to conn->lock_list, a concurrent UNLOCK request on the same connection can find the lock object and kfree() it before the rollback loop executes. When the granting thread subsequently walks rollback_list, it dereferences and frees the already-freed ksmbd_lock structure, resulting in a Use-After-Free and Double-Free (on both ksmbd_lock and struct file_lock). Fix this by deferring the publication of granted locks to conn->lock_list and fp->lock_list until after the entire array of lock elements has been processed without error. Mid-batch grants remain tracked exclusively on the request-local rollback_list until the whole batch succeeds, eliminating the race window.

Why it matters now

EPSS 0.00702 53rd percentileScored 2026-11-07
Fix Fixed Linux (Linux): 6.1.191, 6.6.160, 6.12.114 +3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.15 and later6.1.191, 6.6.160, 6.12.114, 6.18.57, 7.2.6, 7.3Patch availableCNA
  • Linux VendorLinux Affected 5.15 and later Fixed in 6.1.191, 6.6.160, 6.12.114, 6.18.57, 7.2.6, 7.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.160, 6.12.114, 6.18.57, 7.2.6, 7.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 7 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90162
  2. 2026-10-03 Alias added: GHSA-x2qc-qfqc-6vmr
  3. 2026-10-13 Affected versions changed · Red Hat
  4. 2026-10-13 CVSS score added · Red Hat
  5. 2026-10-16 Fix available: Linux/[email protected], Linux/Linux@ff6870cf3b7eccc69d03cbb6f23e3995d96e9a8d · CNA
  6. 2026-10-16 1 new reference · CNA
  7. 2026-10-19 Fix available: Linux/[email protected] · CNA
  8. 2026-10-21 Fix available: Linux/[email protected], Linux/[email protected], Linux/Linux@65f54ed0289e9a57e6c60b14347ccea4c318f1fc +1 · CNA
  9. 2026-10-21 2 new references · CNA
  10. 2026-10-23 EPSS moved to the 50th–90th percentile
  11. 2026-10-30 Fix available: Linux/[email protected], Linux/Linux@f1371a140722c1d6868f9acf69d601de7d4142bf · CNA
  12. 2026-10-30 1 new reference · CNA
  13. 2026-10-30 Affected versions changed · Red Hat

References

Other 6

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences