APPLIED[N:hwe-6.17]: [SRU][Q][PATCH 0/1] CVE-2026-53010

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-next. Thanks.

On 7/17/26 02:59, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53010
>
> [ Impact ]
>
> In smb2_open, the ksmbd server drops the reference to the durable file
> descriptor early during the durable reconnect process via
> ksmbd_put_durable_fd(fp). If an error occurs subsequently (for example,
> ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, this leads to a use-
> after-free when accessing fp properties such as fp->create_time. With a CVSS
> score of 9.8, this flaw could be exploited by a remote attacker to corrupt
> memory, potentially leading to denial of service or arbitrary code execution.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change to the ksmbd SMB2 server could affect durable
> handle reconnect handling, potentially causing incorrect reference counting
> that results in file descriptor leaks or premature frees. Any error would be
> confined to the ksmbd subsystem and SMB2/SMB3 file serving.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/e39d142c/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/e39d142c/attachment.sig>