CVE-2026-64437

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on

double SMB2_CANCEL") made smb2_cancel() skip a work whose state is

KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But

KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same

freeing producer path is reached for CLOSED too:

SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets

the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock()

worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s

the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes

the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the

cancelled branch, skips release_async_work(). The work stays on

conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock

pointing at the freed file_lock.

A subsequent SMB2_CANCEL for the same AsyncId then passes the

KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so

smb2_cancel() fires cancel_fn again over the freed file_lock -- the same

use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:

BUG: KASAN: slab-use-after-free in __locks_delete_block

__locks_delete_block

locks_delete_block

ksmbd_vfs_posix_lock_unblock

smb2_remove_blocked_lock

smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn

handle_ksmbd_work

Allocated by ...: locks_alloc_lock <- smb2_lock

Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit)

... cache file_lock_cache of size 192

Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with

KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is

silent on that kernel, so the splat is attributable to the CLOSE trigger.

Only an ACTIVE deferred work may have its cancel_fn fired: both terminal

states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees

the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE

so any non-active work is skipped.