CVE-2026-31718
- Source
- https://cve.org/CVERecord?id=CVE-2026-31718
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31718.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-31718
- Downstream
- Related
- Published
- 2026-05-01T13:56:12.680Z
- Modified
- 2026-05-19T03:52:00.571784314Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in __ksmbdclosefd() via durable scavenger
When a durable file handle survives session disconnect (TCP close without SMB2LOGOFF), sessionfdcheck() sets fp->conn = NULL to preserve the handle for later reconnection. However, it did not clean up the byte-range locks on fp->locklist.
Later, when the durable scavenger thread times out and calls __ksmbdclosefd(NULL, fp), the lock cleanup loop did:
spin_lock(&fp->conn->llist_lock);This caused a slab use-after-free because fp->conn was NULL and the original connection object had already been freed by ksmbdtcpdisconnect().
The root cause is asymmetric cleanup: lock entries (smblock->clist) were left dangling on the freed conn->locklist while fp->conn was nulled out.
To fix this issue properly, we need to handle the lifetime of smblock->clist across three paths: - Safely skip clist deletion when list is empty and fp->conn is NULL. - Remove the lock from the old connection's locklist in sessionfdcheck() - Re-add the lock to the new connection's locklist in ksmbdreopendurablefd().
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31718.json" }- References
-
- https://git.kernel.org/stable/c/0000a7780e0e446a28a273572f6ea8f7f582f694
- https://git.kernel.org/stable/c/235e32320a470fcd3998fb3774f2290a0eb302a1
- https://git.kernel.org/stable/c/3d6682726c2d3a46d31dae88b8166786b09b03ad
- https://git.kernel.org/stable/c/b34fc42cfe922e551f7a27d3ac3bb016e41d7dd9
- https://git.kernel.org/stable/c/e33c65f011980b4ad4abfd93585ec2079856368f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31718.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-31718
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8df4bcdb0a4232192b2445256c39b787d58ef14dFixed0000a7780e0e446a28a273572f6ea8f7f582f694
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc8efcc786146a951091588e5fa7e3c754850cb3cFixede33c65f011980b4ad4abfd93585ec2079856368fFixed3d6682726c2d3a46d31dae88b8166786b09b03adFixedb34fc42cfe922e551f7a27d3ac3bb016e41d7dd9Fixed235e32320a470fcd3998fb3774f2290a0eb302a1
Affected versions
v6.*
Linux / Kernel
Package
- Name
- Kernel