Vulnerabilities

Vulnerability · CVE-2026-90162

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid-batch gra…

Published Sep 17, 2026 · catalog updated Oct 15, 2026 · the affected product

Check if you run it

No confirmed exploitation is on record for CVE-2026-90162. EPSS is 0.63%. Act only if a listed version of the affected product is installed.

Severity

High8.8

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.63%

Remediation

Not established

Affected products

See sources for product scope

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid-batch granted locks are published to connection-wide (conn->lock_list) and file-wide (fp->lock_list) lists immediately upon vfs_lock_file() success, while also remaining tracked on the stack-local rollback_list. If a subsequent element in the same SMB2_LOCK request array fails validation or execution, the thread jumps to out: and walks rollback_list to undo previously granted locks. However, because the granted lock was already published to conn->lock_list, a concurrent UNLOCK request on the same connection can find the lock object and kfree() it before the rollback loop executes. When the granting thread subsequently walks rollback_list, it dereferences and frees the already-freed ksmbd_lock structure, resulting in a Use-After-Free and Double-Free (on both ksmbd_lock and struct file_lock). Fix this by deferring the publication of granted locks to conn->lock_list and fp->lock_list until after the entire array of lock elements has been processed without error. Mid-batch grants remain tracked exclusively on the request-local rollback_list until the whole batch succeeds, eliminating the race window.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.