CVE-2026-31444

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31444", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.090Z", "datePublished": "2026-04-22T13:53:41.351Z", "dateUpdated": "2026-08-05T12:22:35.585Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:35.585Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free and NULL deref in smb_grant_oplock()\n\nsmb_grant_oplock() has two issues in the oplock publication sequence:\n\n1) opinfo is linked into ci->m_op_list (via opinfo_add) before\n add_lease_global_list() is called. If add_lease_global_list()\n fails (kmalloc returns NULL), the error path frees the opinfo\n via __free_opinfo() while it is still linked in ci->m_op_list.\n Concurrent m_op_list readers (opinfo_get_list, or direct iteration\n in smb_break_all_levII_oplock) dereference the freed node.\n\n2) opinfo->o_fp is assigned after add_lease_global_list() publishes\n the opinfo on the global lease list. A concurrent\n find_same_lease_key() can walk the lease list and dereference\n opinfo->o_fp->f_ci while o_fp is still NULL.\n\nFix by restructuring the publication sequence to eliminate post-publish\nfailure:\n\n- Set opinfo->o_fp before any list publication (fixes NULL deref).\n- Preallocate lease_table via alloc_lease_table() before opinfo_add()\n so add_lease_global_list() becomes infallible after publication.\n- Keep the original m_op_list publication order (opinfo_add before\n lease list) so concurrent opens via same_client_has_lease() and\n opinfo_get_list() still see the in-flight grant.\n- Use opinfo_put() instead of __free_opinfo() on err_out so that\n the RCU-deferred free path is used.\n\nThis also requires splitting add_lease_global_list() to take a\npreallocated lease_table and changing its return type from int to void,\nsince it can no longer fail."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is reachable through ksmbd over SMB on TCP/445 via SMB2 CREATE/open requests carrying lease contexts.\nAC:L - An attacker can drive the relevant lease/oplock publication races with concurrent SMB opens and attacker-chosen lease keys/client GUIDs; no condition outside attacker influence is required for the NULL dereference path.\nPR:N - Although SMB2 CREATE requires a valid session and tree connection, ksmbd supports guest/anonymous sessions and guest shares, making unauthenticated remote triggering reasonable in exposed deployments.\nUI:N - No victim user action is needed once the ksmbd service and share are reachable; the attacker sends SMB protocol requests directly.\nS:U - The vulnerability affects the kernel SMB server within the same host security authority and does not cross a separate security boundary such as a VM escape.\nC:H - The bug includes a use-after-free of struct oplock_info left reachable from shared lists, which can plausibly be leveraged for kernel memory disclosure through heap reuse.\nI:H - The use-after-free is kernel memory corruption in a network-reachable path and can plausibly be exploited for control-flow or data-structure corruption.\nA:H - Both the NULL dereference and use-after-free can crash or oops the kernel, causing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/oplock.c"], "versions": [{"version": "302fef75512b2c8329a3f5efab1ae7ba2562387a", "lessThan": "9e785f004cbc56390479b77375726ea9b0d1a8a6", "status": "affected", "versionType": "git"}, {"version": "08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c", "lessThan": "7de55bba69cbf0f9280daaea385daf08bc076121", "status": "affected", "versionType": "git"}, {"version": "1d6abf145615dbfe267ce3b0a271f95e3780e18e", "lessThan": "a5c6f6d6ceefed2d5210ee420fb75f8362461f46", "status": "affected", "versionType": "git"}, {"version": "ce8507ee82c888126d8e7565e27c016308d24cde", "lessThan": "6d7e5a918c1d0aad06db0e17677b66fc9a471021", "status": "affected", "versionType": "git"}, {"version": "1dfd062caa165ec9d7ee0823087930f3ab8a6294", "lessThan": "48623ec358c1c600fa1e38368746f933e0f1a617", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/oplock.c"], "versions": [{"version": "6.6.130", "lessThan": "6.6.131", "status": "affected", "versionType": "semver"}, {"version": "6.12.78", "lessThan": "6.12.80", "status": "affected", "versionType": "semver"}, {"version": "6.18.19", "lessThan": "6.18.21", "status": "affected", "versionType": "semver"}, {"version": "6.19.9", "lessThan": "6.19.11", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.130", "versionEndExcluding": "6.6.131"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.78", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.19", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.9", "versionEndExcluding": "6.19.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9e785f004cbc56390479b77375726ea9b0d1a8a6"}, {"url": "https://git.kernel.org/stable/c/7de55bba69cbf0f9280daaea385daf08bc076121"}, {"url": "https://git.kernel.org/stable/c/a5c6f6d6ceefed2d5210ee420fb75f8362461f46"}, {"url": "https://git.kernel.org/stable/c/6d7e5a918c1d0aad06db0e17677b66fc9a471021"}, {"url": "https://git.kernel.org/stable/c/48623ec358c1c600fa1e38368746f933e0f1a617"}], "title": "ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/oplock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9e785f004cbc56390479b77375726ea9b0d1a8a6", "status": "affected", "version": "302fef75512b2c8329a3f5efab1ae7ba2562387a", "versionType": "git"}, {"lessThan": "7de55bba69cbf0f9280daaea385daf08bc076121", "status": "affected", "version": "08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c", "versionType": "git"}, {"lessThan": "a5c6f6d6ceefed2d5210ee420fb75f8362461f46", "status": "affected", "version": "1d6abf145615dbfe267ce3b0a271f95e3780e18e", "versionType": "git"}, {"lessThan": "6d7e5a918c1d0aad06db0e17677b66fc9a471021", "status": "affected", "version": "ce8507ee82c888126d8e7565e27c016308d24cde", "versionType": "git"}, {"lessThan": "48623ec358c1c600fa1e38368746f933e0f1a617", "status": "affected", "version": "1dfd062caa165ec9d7ee0823087930f3ab8a6294", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/oplock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.6.131", "status": "affected", "version": "6.6.130", "versionType": "semver"}, {"lessThan": "6.12.80", "status": "affected", "version": "6.12.78", "versionType": "semver"}, {"lessThan": "6.18.21", "status": "affected", "version": "6.18.19", "versionType": "semver"}, {"lessThan": "6.19.11", "status": "affected", "version": "6.19.9", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "32BFB596-06E1-4DA3-9777-1ED37BA1744B", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.78", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "75041A3B-374A-4909-A065-48064ABDEC6C", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F3885A44-8CC0-4992-8F4A-B68D3E58E912", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6.130:*:*:*:*:*:*:*", "matchCriteriaId": "BBE4A27D-9A72-4C12-BFE0-E9811803AC96", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free and NULL deref in smb_grant_oplock()\n\nsmb_grant_oplock() has two issues in the oplock publication sequence:\n\n1) opinfo is linked into ci->m_op_list (via opinfo_add) before\n add_lease_global_list() is called. If add_lease_global_list()\n fails (kmalloc returns NULL), the error path frees the opinfo\n via __free_opinfo() while it is still linked in ci->m_op_list.\n Concurrent m_op_list readers (opinfo_get_list, or direct iteration\n in smb_break_all_levII_oplock) dereference the freed node.\n\n2) opinfo->o_fp is assigned after add_lease_global_list() publishes\n the opinfo on the global lease list. A concurrent\n find_same_lease_key() can walk the lease list and dereference\n opinfo->o_fp->f_ci while o_fp is still NULL.\n\nFix by restructuring the publication sequence to eliminate post-publish\nfailure:\n\n- Set opinfo->o_fp before any list publication (fixes NULL deref).\n- Preallocate lease_table via alloc_lease_table() before opinfo_add()\n so add_lease_global_list() becomes infallible after publication.\n- Keep the original m_op_list publication order (opinfo_add before\n lease list) so concurrent opens via same_client_has_lease() and\n opinfo_get_list() still see the in-flight grant.\n- Use opinfo_put() instead of __free_opinfo() on err_out so that\n the RCU-deferred free path is used.\n\nThis also requires splitting add_lease_global_list() to take a\npreallocated lease_table and changing its return type from int to void,\nsince it can no longer fail."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corrige uso despu\u00e9s de liberaci\u00f3n y desreferencia NULL en smb_grant_oplock()\n\nsmb_grant_oplock() tiene dos problemas en la secuencia de publicaci\u00f3n de oplock:\n\n1) opinfo se enlaza en ci -> m_op_list (a trav\u00e9s de opinfo_add) antes de que se llame a add_lease_global_list(). Si add_lease_global_list() falla (kmalloc devuelve NULL), la ruta de error libera el opinfo a trav\u00e9s de __free_opinfo() mientras a\u00fan est\u00e1 enlazado en ci -> m_op_list. Lectores concurrentes de m_op_list (opinfo_get_list, o iteraci\u00f3n directa en smb_break_all_levII_oplock) desreferencian el nodo liberado.\n\n2) opinfo -> o_fp se asigna despu\u00e9s de que add_lease_global_list() publica el opinfo en la lista global de arrendamientos. Un find_same_lease_key() concurrente puede recorrer la lista de arrendamientos y desreferenciar opinfo -> o_fp -> f_ci mientras o_fp a\u00fan es NULL.\n\nSe corrige reestructurando la secuencia de publicaci\u00f3n para eliminar fallos posteriores a la publicaci\u00f3n:\n\n- Establecer opinfo -> o_fp antes de cualquier publicaci\u00f3n en lista (corrige la desreferencia NULL).\n- Preasignar lease_table a trav\u00e9s de alloc_lease_table() antes de opinfo_add() para que add_lease_global_list() se vuelva infalible despu\u00e9s de la publicaci\u00f3n.\n- Mantener el orden de publicaci\u00f3n original de m_op_list (opinfo_add antes de la lista de arrendamientos) para que las aperturas concurrentes a trav\u00e9s de same_client_has_lease() y opinfo_get_list() a\u00fan vean la concesi\u00f3n en curso.\n- Usar opinfo_put() en lugar de __free_opinfo() en err_out para que se utilice la ruta de liberaci\u00f3n diferida por RCU.\n\nEsto tambi\u00e9n requiere dividir add_lease_global_list() para que tome una lease_table preasignada y cambiar su tipo de retorno de int a void, ya que ya no puede fallar."}], "id": "CVE-2026-31444", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-22T14:16:38.010", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48623ec358c1c600fa1e38368746f933e0f1a617"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d7e5a918c1d0aad06db0e17677b66fc9a471021"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7de55bba69cbf0f9280daaea385daf08bc076121"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9e785f004cbc56390479b77375726ea9b0d1a8a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a5c6f6d6ceefed2d5210ee420fb75f8362461f46"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()", "id": "2460707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460707"}, "csaw": false, "cwe": "CWE-476", "details": ["A flaw was found in ksmbd, a component of the Linux kernel. This vulnerability involves a use-after-free and a NULL pointer dereference within the `smb_grant_oplock()` function during the oplock publication sequence. An attacker could potentially exploit these issues, leading to memory corruption. This could result in a denial of service (DoS) due to system instability or crashes."], "name": "CVE-2026-31444", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31444\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31444\nhttps://lore.kernel.org/linux-cve-announce/2026042245-CVE-2026-31444-8b6e@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[302fef75512b2c8329a3f5efab1ae7ba2562387a,9e785f004cbc56390479b77375726ea9b0d1a8a6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c,7de55bba69cbf0f9280daaea385daf08bc076121)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d6abf145615dbfe267ce3b0a271f95e3780e18e,a5c6f6d6ceefed2d5210ee420fb75f8362461f46)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ce8507ee82c888126d8e7565e27c016308d24cde,6d7e5a918c1d0aad06db0e17677b66fc9a471021)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1dfd062caa165ec9d7ee0823087930f3ab8a6294,48623ec358c1c600fa1e38368746f933e0f1a617)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.130,6.6.131)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.78,6.12.80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.19,6.18.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.9,6.19.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-22T15:45:20.720006+00:00", "updated": "2026-05-07T20:30:15.271715+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}