[SRU][Q][PATCH 0/1] CVE-2026-53010

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53010

[ Impact ]

In smb2_open, the ksmbd server drops the reference to the durable file
descriptor early during the durable reconnect process via
ksmbd_put_durable_fd(fp). If an error occurs subsequently (for example,
ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, this leads to a use-
after-free when accessing fp properties such as fp->create_time. With a CVSS
score of 9.8, this flaw could be exploited by a remote attacker to corrupt
memory, potentially leading to denial of service or arbitrary code execution.

[ Fix ]

questing: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this change to the ksmbd SMB2 server could affect durable
handle reconnect handling, potentially causing incorrect reference counting
that results in file descriptor leaks or premature frees. Any error would be
confined to the ksmbd subsystem and SMB2/SMB3 file serving.