CVE-2026-53198

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ksmbd module of the Linux kernel. A deferred byte-range lock registers asynchronous work via setup async work(), where the cancel fn is set to smb2 remove blocked lock and cancel argv[0] points to the file lock structure. When a request is cancelled, the worker frees the file lock using locks free lock() but fails to reach release async work(), leaving the work matchable on conn->async requests with a pointer to the freed memory. Because smb2 cancel() executes the cancel fn without a state guard, a second SMB2 CANCEL request for the same AsyncId can trigger smb2 remove blocked lock() again, resulting in a slab use-after-free. This was reproduced by an authenticated SMB client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.