---
id: CVE-2026-90162
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: defer publishing granted locks to prevent UAF/double-free race

  In smb2_lock(), mid-batch granted locks are published to connection-wide
  (conn->lock_list) and fi…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: defer publishing granted locks to prevent UAF/double-free race

  In smb2_lock(), mid-batch granted locks are published to connection-wide
  (conn->lock_list) and fi…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <
    a1d26dfb32919088e3638dca01068df3c4507433
  - >-
    Linux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <
    29f74f0f2e6df3b393b7b66e810136d0c64e3c59
  - Linux 5.15
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:44.827'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90162'
references:
  - url: 'https://git.kernel.org/stable/c/29f74f0f2e6df3b393b7b66e810136d0c64e3c59'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a1d26dfb32919088e3638dca01068df3c4507433'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00575
epssPercentile: 0.45232
ingestedAt: '2026-09-17T16:21:47.871Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer publishing granted locks to prevent UAF/double-free race

In smb2_lock(), mid-batch granted locks are published to connection-wide
(conn->lock_list) and file-wide (fp->lock_list) lists immediately upon
vfs_lock_file() success, while also remaining tracked on the stack-local
rollback_list.

If a subsequent element in the same SMB2_LOCK request array fails
validation or execution, the thread jumps to out: and walks
rollback_list to undo previously granted locks. However, because the
granted lock was already published to conn->lock_list, a concurrent
UNLOCK request on the same connection can find the lock object and
kfree() it before the rollback loop executes.

When the granting thread subsequently walks rollback_list, it
dereferences and frees the already-freed ksmbd_lock structure, resulting
in a Use-After-Free and Double-Free (on both ksmbd_lock and struct
file_lock).

Fix this by deferring the publication of granted locks to
conn->lock_list and fp->lock_list until after the entire array of lock
elements has been processed without error. Mid-batch grants remain
tracked exclusively on the request-local rollback_list until the whole
batch succeeds, eliminating the race window.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.