CVE-2026-72492
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in same_client_has_lease() same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. smb_grant_oplock() then dereferences that pointer in copy_lease() and when checking breaking_cnt. A concurrent close can remove the old lease from ci->m_op_list and drop the last reference before the caller uses the returned pointer, leading to a use-after-free. Take a reference when same_client_has_lease() selects an existing lease, drop any previous match while scanning, and release the returned reference in smb_grant_oplock() after copying the lease state.
How to fix
- Linux Linuxaaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0, 09634cd055d9bd8dd167995ea52bcd8028dd5dac, 7c3264d273d524aa6adcce23c01087271f13586f, 79c7c59bb519db6f5a2a151965e825ec725614cc, 35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d, 0ff82a9cf9312678d8bc4edeef0b6e82659ac12a, 65b655f65c3ca1ab5d598d3832bb0ff531725858 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 ≤ v < aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 ≤ v < 09634cd055d9bd8dd167995ea52bcd8028dd5dac, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 ≤ v < 7c3264d273d524aa6adcce23c01087271f13586f, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 ≤ v < 79c7c59bb519db6f5a2a151965e825ec725614cc, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 ≤ v < 35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 ≤ v < 0ff82a9cf9312678d8bc4edeef0b6e82659ac12a, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 ≤ v < 65b655f65c3ca1ab5d598d3832bb0ff531725858, 5.15 | aaa3bb2bbf2ccbfea9e4e0b9dabf3afc60b50cd0, 09634cd055d9bd8dd167995ea52bcd8028dd5dac, 7c3264d273d524aa6adcce23c01087271f13586f, 79c7c59bb519db6f5a2a151965e825ec725614cc, 35d3d6ff2bc1e7aaecb15d5377ebbd6227acae0d, 0ff82a9cf9312678d8bc4edeef0b6e82659ac12a, 65b655f65c3ca1ab5d598d3832bb0ff531725858 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.