ACK: [SRU][Q][PATCH 0/1] CVE-2026-53010

[Bethany Jamison]

On 7/16/26 7:59 PM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53010
>
> [ Impact ]
>
> In smb2_open, the ksmbd server drops the reference to the durable file
> descriptor early during the durable reconnect process via
> ksmbd_put_durable_fd(fp). If an error occurs subsequently (for example,
> ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, this leads to a use-
> after-free when accessing fp properties such as fp->create_time. With a CVSS
> score of 9.8, this flaw could be exploited by a remote attacker to corrupt
> memory, potentially leading to denial of service or arbitrary code execution.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change to the ksmbd SMB2 server could affect durable
> handle reconnect handling, potentially causing incorrect reference counting
> that results in file descriptor leaks or premature frees. Any error would be
> confined to the ksmbd subsystem and SMB2/SMB3 file serving.
>
Signed-off-by: Bethany Jamison <bethany.jamison at canonical.com>