CVE-2026-90162 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: defer publishing granted locks to prevent UAF/double-free race
In smb2_lock(), mid-batch granted locks are published to connection-wide (conn->lock_list) and file-wide (fp->lock_list) lists immediately upon vfs_lock_file() success, while also remaining tracked on the stack-local rollback_list.
If a subsequent element in the same SMB2_LOCK request array fails validation or execution, the thread jumps to out: and walks rollback_list to undo previously granted locks. However, because the granted lock was already published to conn->lock_list, a concurrent UNLOCK request on the same connection can find the lock object and kfree() it before the rollback loop executes.
When the granting thread subsequently walks rollback_list, it dereferences and frees the already-freed ksmbd_lock structure, resulting in a Use-After-Free and Double-Free (on both ksmbd_lock and struct file_lock).
Fix this by deferring the publication of granted locks to conn->lock_list and fp->lock_list until after the entire array of lock elements has been processed without error. Mid-batch grants remain tracked exclusively on the request-local rollback_list until the whole batch succeeds, eliminating the race window.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's ksmbd module represents a critical concurrency flaw rooted in improper synchronization during resource management within SMB2 lock handling operations. Specifically, the issue resides in the smb2_lock function where granted file locks are published to connection-wide and file-wide lists immediately upon successful validation by vfs_lock_file. This immediate publication creates a race condition window because the lock objects become visible to other threads before the entire batch of requested locks has been fully validated. The design assumes that if any subsequent element in an SMB2_LOCK request array fails, the system can safely rollback all previously granted locks within that same atomic operation. However, this assumption ignores the possibility of concurrent access from unrelated requests targeting the same connection or file structure during the brief interval between publication and potential rollback execution.
When a validation failure occurs for any lock element in the batch, the kernel thread is directed to an error handling path labeled out, which iterates through a local rollback list to undo previously granted locks. The critical flaw emerges because these locks were already added to global data structures such as conn->lock_list and fp->lock_list prior to this failure detection. Consequently, another concurrent UNLOCK request originating from a different client or thread can locate the lock object within these published lists and proceed to free it using kfree before the original granting thread completes its rollback sequence. This scenario results in a Use-After-Free condition where the rolling-back thread attempts to dereference and free memory that has already been released by the concurrent UNLOCK operation, leading to potential kernel panic or arbitrary code execution depending on heap state exploitation possibilities.
The operational impact of this vulnerability is severe due to its direct correlation with double-free errors affecting both ksmbd_lock structures and underlying struct file_lock objects. Such memory corruption can destabilize the entire kernel subsystem managing network file sharing services, potentially allowing an authenticated attacker who sends crafted SMB2 LOCK requests to trigger remote code execution or cause denial-of-service conditions by crashing the server process. The vulnerability is particularly dangerous because it requires no special privileges beyond valid authentication for the affected share and exploits standard protocol behavior patterns that are common in enterprise environments relying on Windows file sharing over Linux servers via ksmbd implementations.
From a classification perspective, this flaw aligns with CWE-416 Use After Free and CWE-415 Double Free vulnerabilities as defined by Common Weakness Enumeration standards. In terms of adversarial tactics, the exploitation path relates to ATT&CK technique T1059 Command and Scripting Interpreter if used for initial access followed by privilege escalation through kernel memory corruption, though primarily it falls under resource management failures typical in network service daemons handling concurrent requests without adequate locking granularity. The root cause is fundamentally a synchronization issue where atomicity of the batch operation was not maintained across publication boundaries.
To mitigate this vulnerability, the implemented fix defers the publishing of granted locks to connection-wide and file-wide lists until after the entire array of lock elements has been processed successfully without error. During processing, mid-batch grants remain tracked exclusively on a request-local rollback list that is isolated from concurrent access by other threads. This architectural change eliminates the race window entirely because no external thread can observe or interact with partially granted locks until the batch operation reaches a committed state where all validations have passed. Administrators should ensure their systems are updated to include this patch and verify that ksmbd service configurations enforce strict authentication controls while monitoring for any anomalous SMB2 lock request patterns that might indicate attempted exploitation of similar race conditions in unpatched versions.