CVE-2026-45924

ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths

Published May 27, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths

There are two places where ksmbd_vfs_kern_path_end_removing() needs to be
called in order to balance what the corresponding successful call to
ksmbd_vfs_kern_path_start_removing() has done, i.e. drop inode locks and
put the taken references. Otherwise there might be potential deadlocks
and unbalanced locks which are caught like:

BUG: workqueue leaked lock or atomic: kworker/5:21/0x00000000/7596
last function: handle_ksmbd_work
2 locks held by kworker/5:21/7596:
#0: ffff8881051ae448 (sb_writers#3){.+.+}-{0:0}, at: ksmbd_vfs_kern_path_locked+0x142/0x660
#1: ffff888130e966c0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: ksmbd_vfs_kern_path_locked+0x17d/0x660
CPU: 5 PID: 7596 Comm: kworker/5:21 Not tainted 6.1.162-00456-gc29b353f383b #138
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
Workqueue: ksmbd-io handle_ksmbd_work
Call Trace:
<TASK>
dump_stack_lvl+0x44/0x5b
process_one_work.cold+0x57/0x5c
worker_thread+0x82/0x600
kthread+0x153/0x190
ret_from_fork+0x22/0x30
</TASK>

Found by Linux Verification Center (linuxtesting.org).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9d5012ffe14120f978ee34aef4df3d6cb026b7c4`	affected	< 8e3a3192ef78d8302916408d62813b1fddfc8972
`ac98d54630d5b52e3f684d872f0d82c06c418ea9`	affected	< f221baa80e5959a0c08a7e34abbf2a4d3cf0e1c2
`1e858a7a51c7b8b009d8f246de7ceb7743b44a71`	affected	< cf29329a13df79c198b45dfc92577638d30b56fa
`814cfdb6358d9b84fcbec9918c8f938cc096a43a`	affected	< 34d6691933682f0516259a31b39d2cebcedec0a5
`d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694`	affected	< 0c578e8065c4b08d5635a4cbc0f6321df9d20f79
`d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694`	affected	< 4c38600feb81c670edb82e49d201d3d2d00cd4c3
`d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694`	affected	< a09dc10d1353f0e92c21eae2a79af1c2b1ddcde8
`a7dddd62578c2eb6cb28b8835556a121b5157323`	affected	—
`a726fef6d7d4cfc365d3434e3916dbfe78991a33`	affected	—
`5.15.190`	affected	< 5.15.203
`6.1.149`	affected	< 6.1.167
`6.6.103`	affected	< 6.6.130
`6.12.43`	affected	< 6.12.78
`6.15.11`	affected	< 6.16
`6.16.2`	affected	< 6.17

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.4`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[9d5012ffe14120f978ee34aef4df3d6cb026b7c4,8e3a3192ef78d8302916408d62813b1fddfc8972)`	affected	code_commit	—
`[ac98d54630d5b52e3f684d872f0d82c06c418ea9,f221baa80e5959a0c08a7e34abbf2a4d3cf0e1c2)`	affected	code_commit	—
`[1e858a7a51c7b8b009d8f246de7ceb7743b44a71,cf29329a13df79c198b45dfc92577638d30b56fa)`	affected	code_commit	—
`[814cfdb6358d9b84fcbec9918c8f938cc096a43a,34d6691933682f0516259a31b39d2cebcedec0a5)`	affected	code_commit	—
`[d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694,0c578e8065c4b08d5635a4cbc0f6321df9d20f79)`	affected	code_commit	—
`[d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694,4c38600feb81c670edb82e49d201d3d2d00cd4c3)`	affected	code_commit	—
`[d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694,a09dc10d1353f0e92c21eae2a79af1c2b1ddcde8)`	affected	code_commit	—
`a7dddd62578c2eb6cb28b8835556a121b5157323`	affected	code_commit	—
`a726fef6d7d4cfc365d3434e3916dbfe78991a33`	affected	code_commit	—
`[5.15.190,5.15.203)`	affected	semver	—
`[6.1.149,6.1.167)`	affected	semver	—
`[6.6.103,6.6.130)`	affected	semver	—
`[6.12.43,6.12.78)`	affected	semver	—
`[6.15.11,6.16)`	affected	semver	—
`[6.16.2,6.17)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.17`	affected	semver	—
`[0,6.17)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.4,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.121% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c578e8065c4b08d5635a4cbc0f6321df9d20f79
https://git.kernel.org/stable/c/34d6691933682f0516259a31b39d2cebcedec0a5
https://git.kernel.org/stable/c/4c38600feb81c670edb82e49d201d3d2d00cd4c3
https://git.kernel.org/stable/c/8e3a3192ef78d8302916408d62813b1fddfc8972
https://git.kernel.org/stable/c/a09dc10d1353f0e92c21eae2a79af1c2b1ddcde8
https://git.kernel.org/stable/c/cf29329a13df79c198b45dfc92577638d30b56fa
https://git.kernel.org/stable/c/f221baa80e5959a0c08a7e34abbf2a4d3cf0e1c2
https://lore.kernel.org/linux-cve-announce/2026052725-CVE-2026-45924-5cd5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45924
https://www.cve.org/CVERecord?id=CVE-2026-45924

History

May 28, 2026 3:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-503

May 28, 2026 12:15 PM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026052725-CVE-2026-45924-5cd5@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45924 https://www.cve.org/CVERecord?id=CVE-2026-45924

May 27, 2026 6:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-503

May 27, 2026 2:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths There are two places where ksmbd_vfs_kern_path_end_removing() needs to be called in order to balance what the corresponding successful call to ksmbd_vfs_kern_path_start_removing() has done, i.e. drop inode locks and put the taken references. Otherwise there might be potential deadlocks and unbalanced locks which are caught like: BUG: workqueue leaked lock or atomic: kworker/5:21/0x00000000/7596 last function: handle_ksmbd_work 2 locks held by kworker/5:21/7596: #0: ffff8881051ae448 (sb_writers#3){.+.+}-{0:0}, at: ksmbd_vfs_kern_path_locked+0x142/0x660 #1: ffff888130e966c0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: ksmbd_vfs_kern_path_locked+0x17d/0x660 CPU: 5 PID: 7596 Comm: kworker/5:21 Not tainted 6.1.162-00456-gc29b353f383b #138 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: ksmbd-io handle_ksmbd_work Call Trace: <TASK> dump_stack_lvl+0x44/0x5b process_one_work.cold+0x57/0x5c worker_thread+0x82/0x600 kthread+0x153/0x190 ret_from_fork+0x22/0x30 </TASK> Found by Linux Verification Center (linuxtesting.org).
Title		ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c578e8065c4b08d5635a4cbc0f6321df9d20f79 https://git.kernel.org/stable/c/34d6691933682f0516259a31b39d2cebcedec0a5 https://git.kernel.org/stable/c/4c38600feb81c670edb82e49d201d3d2d00cd4c3 https://git.kernel.org/stable/c/8e3a3192ef78d8302916408d62813b1fddfc8972 https://git.kernel.org/stable/c/a09dc10d1353f0e92c21eae2a79af1c2b1ddcde8 https://git.kernel.org/stable/c/cf29329a13df79c198b45dfc92577638d30b56fa https://git.kernel.org/stable/c/f221baa80e5959a0c08a7e34abbf2a4d3cf0e1c2