[SRU][Q][PATCH 0/1] CVE-2026-53046

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53046

[ Impact ]

ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does
not handle the -EINPROGRESS return code from async hardware crypto engines like
the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats
it as an error and immediately frees the request while the hardware DMA
operation is still in flight. The DMA completion callback then dereferences
freed memory, causing a use-after-free and NULL pointer crash. This can lead to
a remote crash or potential memory corruption on affected systems.

[ Fix ]

questing: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression would manifest in the ksmbd SMB3 server, affecting encrypted
connections that rely on AEAD crypto requests. If the fix is incorrect, it
could cause hangs or crashes during message encryption/decryption, particularly
on systems using async hardware crypto engines.