CVE-2026-31444

{"id": "CVE-2026-31444", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "302fef75512b2c8329a3f5efab1ae7ba2562387a", "lessThan": "9e785f004cbc56390479b77375726ea9b0d1a8a6", "versionType": "git"}, {"status": "affected", "version": "08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c", "lessThan": "7de55bba69cbf0f9280daaea385daf08bc076121", "versionType": "git"}, {"status": "affected", "version": "1d6abf145615dbfe267ce3b0a271f95e3780e18e", "lessThan": "a5c6f6d6ceefed2d5210ee420fb75f8362461f46", "versionType": "git"}, {"status": "affected", "version": "ce8507ee82c888126d8e7565e27c016308d24cde", "lessThan": "6d7e5a918c1d0aad06db0e17677b66fc9a471021", "versionType": "git"}, {"status": "affected", "version": "1dfd062caa165ec9d7ee0823087930f3ab8a6294", "lessThan": "48623ec358c1c600fa1e38368746f933e0f1a617", "versionType": "git"}], "programFiles": ["fs/smb/server/oplock.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6.130", "lessThan": "6.6.131", "versionType": "semver"}, {"status": "affected", "version": "6.12.78", "lessThan": "6.12.80", "versionType": "semver"}, {"status": "affected", "version": "6.18.19", "lessThan": "6.18.21", "versionType": "semver"}, {"status": "affected", "version": "6.19.9", "lessThan": "6.19.11", "versionType": "semver"}], "programFiles": ["fs/smb/server/oplock.c"], "defaultStatus": "unaffected"}]}], "published": "2026-04-22T14:16:38.010", "references": [{"url": "https://git.kernel.org/stable/c/48623ec358c1c600fa1e38368746f933e0f1a617", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6d7e5a918c1d0aad06db0e17677b66fc9a471021", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7de55bba69cbf0f9280daaea385daf08bc076121", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9e785f004cbc56390479b77375726ea9b0d1a8a6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a5c6f6d6ceefed2d5210ee420fb75f8362461f46", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free and NULL deref in smb_grant_oplock()\n\nsmb_grant_oplock() has two issues in the oplock publication sequence:\n\n1) opinfo is linked into ci->m_op_list (via opinfo_add) before\n add_lease_global_list() is called. If add_lease_global_list()\n fails (kmalloc returns NULL), the error path frees the opinfo\n via __free_opinfo() while it is still linked in ci->m_op_list.\n Concurrent m_op_list readers (opinfo_get_list, or direct iteration\n in smb_break_all_levII_oplock) dereference the freed node.\n\n2) opinfo->o_fp is assigned after add_lease_global_list() publishes\n the opinfo on the global lease list. A concurrent\n find_same_lease_key() can walk the lease list and dereference\n opinfo->o_fp->f_ci while o_fp is still NULL.\n\nFix by restructuring the publication sequence to eliminate post-publish\nfailure:\n\n- Set opinfo->o_fp before any list publication (fixes NULL deref).\n- Preallocate lease_table via alloc_lease_table() before opinfo_add()\n so add_lease_global_list() becomes infallible after publication.\n- Keep the original m_op_list publication order (opinfo_add before\n lease list) so concurrent opens via same_client_has_lease() and\n opinfo_get_list() still see the in-flight grant.\n- Use opinfo_put() instead of __free_opinfo() on err_out so that\n the RCU-deferred free path is used.\n\nThis also requires splitting add_lease_global_list() to take a\npreallocated lease_table and changing its return type from int to void,\nsince it can no longer fail."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corrige uso despu\u00e9s de liberaci\u00f3n y desreferencia NULL en smb_grant_oplock()\n\nsmb_grant_oplock() tiene dos problemas en la secuencia de publicaci\u00f3n de oplock:\n\n1) opinfo se enlaza en ci -> m_op_list (a trav\u00e9s de opinfo_add) antes de que se llame a add_lease_global_list(). Si add_lease_global_list() falla (kmalloc devuelve NULL), la ruta de error libera el opinfo a trav\u00e9s de __free_opinfo() mientras a\u00fan est\u00e1 enlazado en ci -> m_op_list. Lectores concurrentes de m_op_list (opinfo_get_list, o iteraci\u00f3n directa en smb_break_all_levII_oplock) desreferencian el nodo liberado.\n\n2) opinfo -> o_fp se asigna despu\u00e9s de que add_lease_global_list() publica el opinfo en la lista global de arrendamientos. Un find_same_lease_key() concurrente puede recorrer la lista de arrendamientos y desreferenciar opinfo -> o_fp -> f_ci mientras o_fp a\u00fan es NULL.\n\nSe corrige reestructurando la secuencia de publicaci\u00f3n para eliminar fallos posteriores a la publicaci\u00f3n:\n\n- Establecer opinfo -> o_fp antes de cualquier publicaci\u00f3n en lista (corrige la desreferencia NULL).\n- Preasignar lease_table a trav\u00e9s de alloc_lease_table() antes de opinfo_add() para que add_lease_global_list() se vuelva infalible despu\u00e9s de la publicaci\u00f3n.\n- Mantener el orden de publicaci\u00f3n original de m_op_list (opinfo_add antes de la lista de arrendamientos) para que las aperturas concurrentes a trav\u00e9s de same_client_has_lease() y opinfo_get_list() a\u00fan vean la concesi\u00f3n en curso.\n- Usar opinfo_put() en lugar de __free_opinfo() en err_out para que se utilice la ruta de liberaci\u00f3n diferida por RCU.\n\nEsto tambi\u00e9n requiere dividir add_lease_global_list() para que tome una lease_table preasignada y cambiar su tipo de retorno de int a void, ya que ya no puede fallar."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "32BFB596-06E1-4DA3-9777-1ED37BA1744B", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.78"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75041A3B-374A-4909-A065-48064ABDEC6C", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3885A44-8CC0-4992-8F4A-B68D3E58E912", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6.130:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBE4A27D-9A72-4C12-BFE0-E9811803AC96"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}