ACK: [SRU][J][PATCH 0/1] CVE-2026-43378

[Manuel Diewald]

On Wed, Jun 24, 2026 at 12:06:42PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43378
> 
> [ Impact ]
> 
> A use-after-free vulnerability exists in the ksmbd SMB server in smb2_open().
> The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced
> after rcu_read_unlock(), creating a use-after-free window where the object may
> have already been freed. With a CVSS score of 9.8, this flaw could allow a
> remote attacker to crash the server or potentially execute arbitrary code in
> the kernel context.
> 
> [ Fix ]
> 
> jammy: backported with AI-assisted adaptation
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> An incorrect fix in the ksmbd SMB server could affect RCU-protected access to
> oplock information during file open operations, potentially leading to
> incorrect oplock handling, data corruption, or new crashes for clients using
> SMB shares served by ksmbd.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Manuel Diewald <manuel.diewald at canonical.com>

-- 
 Manuel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260716/67bcc947/attachment-0001.sig>