[SRU][Q][PATCH 0/1] CVE-2026-43379

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-43379

[ Impact ]

In ksmbd, smb_lazy_parent_lease_break_close() accesses the opinfo pointer
obtained via rcu_dereference(fp->f_opinfo) after rcu_read_unlock() has already
been called. This creates a race condition where a concurrent writer can free
the memory between the unlock and the subsequent pointer dereferences
(opinfo->is_lease, etc.), leading to a use-after-free. As ksmbd is an in-kernel
SMB server processing network requests, this flaw could be triggered remotely
to corrupt memory or crash the system.

[ Fix ]

questing: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix could affect the ksmbd lease break handling path,
potentially causing incorrect lease state transitions or new locking issues
when clients access shared files concurrently over SMB.