CVE-2026-53198

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL<br /> <br /> A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on<br /> conn-&gt;async_requests via setup_async_work(), with cancel_fn =<br /> smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.<br /> <br /> When the request is cancelled, the worker frees the file_lock with<br /> locks_free_lock() and takes the cancelled early-exit, which "goto out"s and never<br /> reaches release_async_work() -- the only site that unlinks the work from<br /> conn-&gt;async_requests and clears cancel_fn/cancel_argv. The work therefore stays<br /> matchable on async_requests with a live cancel_fn pointing at the freed file_lock,<br /> until connection teardown finally runs release_async_work().<br /> <br /> smb2_cancel() fires cancel_fn unconditionally with no state guard, so a second<br /> SMB2_CANCEL for the same AsyncId, arriving in that window, re-runs<br /> smb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free:<br /> <br /> BUG: KASAN: slab-use-after-free in __locks_delete_block<br /> __locks_delete_block<br /> locks_delete_block<br /> ksmbd_vfs_posix_lock_unblock<br /> smb2_remove_blocked_lock<br /> smb2_cancel