APPLIED: [SRU][J][PATCH 0/1] CVE-2026-43378

[Stefan Bader]

On 24/06/2026 11:06, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43378
> 
> [ Impact ]
> 
> A use-after-free vulnerability exists in the ksmbd SMB server in smb2_open().
> The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced
> after rcu_read_unlock(), creating a use-after-free window where the object may
> have already been freed. With a CVSS score of 9.8, this flaw could allow a
> remote attacker to crash the server or potentially execute arbitrary code in
> the kernel context.
> 
> [ Fix ]
> 
> jammy: backported with AI-assisted adaptation
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> An incorrect fix in the ksmbd SMB server could affect RCU-protected access to
> oplock information during file open operations, potentially leading to
> incorrect oplock handling, data corruption, or new crashes for clients using
> SMB shares served by ksmbd.
> 

Applied to jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 52669 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260716/95355a24/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260716/95355a24/attachment-0001.sig>