CVE-2026-64390

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: track the connection owning a byte-range lock<br /> <br /> SMB2_LOCK adds each granted byte-range lock to both the file lock list<br /> and the lock list of the connection which handled the request. The<br /> final close and durable handle paths, however, remove the connection<br /> list entry while holding fp-&gt;conn-&gt;llist_lock.<br /> <br /> With SMB3 multichannel, the connection handling the LOCK request can be<br /> different from the connection which opened the file. The entry can<br /> therefore be removed under a different spinlock from the one protecting<br /> the list it belongs to. A concurrent traversal can then access freed<br /> struct ksmbd_lock and struct file_lock objects.<br /> <br /> Record the connection owning each lock&amp;#39;s clist entry and hold a<br /> reference to it while the entry is linked. Use that connection and its<br /> llist_lock for unlock, rollback, close, and durable preserve. Durable<br /> reconnect assigns the new connection as the owner when publishing the<br /> locks again.