Steve French

The vulnerability is related to a use-after-free issue in the `smb2 set path size()` function. When `smb2 compound op()` is called with a valid `@cfile` and returns `-EINVAL`, the reference to `@cfile` is dropped, but the function may retry the operation without calling `cifs get writable path()` first. This can lead to a slab-use-after-free error, as seen in the KASAN splat when running `fstests` generic/013 against Windows Server 2022.

The issue is related to a null pointer dereference error in the ksmbd component of the Linux kernel. This error occurs when a reused connection is used for a binding session, and the `conn->binding` remains true, causing `generate preauth hash()` not to set `sess->Preauth HashValue`, which is then used as a material to create an encryption key in `ksmbd gen smb311 encryptionkey()`. This results in a null pointer dereference error from `crypto shash update()`. The vulnerability can lead to a kernel NULL pointer dereference.

The issue is related to the `smb2 async writev()` function in the Linux kernel, which is responsible for handling server re-repick on subrequest retry. When a subrequest is marked for needing retry, `netfs` will call `cifs prepare write()`, which makes `cifs` repick the server for the operation before renegotiating credits. This can lead to misaccounting if a different server is selected. The problem manifests as a warning and may be triggered by running certain xfstests against an Azure server in multichannel mode.

The issue is related to the ksmbd component in the Linux kernel, where the `may open()` function does not allow a directory to be opened with write access. However, some writing flags set by the client result in adding write access on the server, making ksmbd incompatible with the FUSE file system. The problem is resolved by discarding the write access when opening a directory. A list add corruption issue is also mentioned, with a kernel bug at `lib/list debug.c:26`. The call trace includes functions such as ` list add valid()`, `fuse finish open()`, and `smb2 open()`.

A problem was found in the Linux Kernel related to the function `sess free buffer()` of the file `fs/cifs/sess.c` in the CIFS Handler component. This issue leads to a double free condition. The exploitation of this issue may allow an attacker to cause a denial of service.

A potential double free issue during a failed mount has been resolved in the Linux kernel, specifically in the cifs component.