CVE-2026-31444
Use-After-Free and NULL Dereference in Linux ksmbd Oplock Handling
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
| linux_kernel | ksmbd | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ksmbd component, specifically in the smb_grant_oplock() function. It involves two main issues during the oplock publication sequence:
- First, an object called opinfo is linked into a list (ci->m_op_list) before a function add_lease_global_list() is called. If add_lease_global_list() fails (due to memory allocation failure), the error handling frees opinfo while it is still linked in the list. This leads to use-after-free errors when other parts of the code concurrently access the list.
- Second, the opinfo->o_fp pointer is assigned after opinfo is published on a global lease list. Concurrent access can cause a NULL pointer dereference because opinfo->o_fp may still be NULL when accessed.
The fix restructures the sequence to set opinfo->o_fp before publishing, preallocates necessary structures to avoid failure after publication, and changes the freeing method to use a deferred free path to prevent use-after-free issues.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free and NULL pointer dereference errors in the Linux kernel's ksmbd service. Such issues can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting these memory errors.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the ksmbd smb_grant_oplock() function has been fixed as described.
The fix involves restructuring the oplock publication sequence to prevent use-after-free and NULL dereference issues, including setting opinfo->o_fp before list publication, preallocating lease_table to make add_lease_global_list() infallible, and using opinfo_put() for deferred freeing.
Therefore, applying the official patch or upgrading to a kernel version that includes this fix is the recommended immediate step.