ACK: [SRU][Q][PATCH 0/1] CVE-2026-43379

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/23/26 11:34, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43379
>
> [ Impact ]
>
> In ksmbd, smb_lazy_parent_lease_break_close() accesses the opinfo pointer
> obtained via rcu_dereference(fp->f_opinfo) after rcu_read_unlock() has already
> been called. This creates a race condition where a concurrent writer can free
> the memory between the unlock and the subsequent pointer dereferences
> (opinfo->is_lease, etc.), leading to a use-after-free. As ksmbd is an in-kernel
> SMB server processing network requests, this flaw could be triggered remotely
> to corrupt memory or crash the system.
>
> [ Fix ]
>
> questing: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix could affect the ksmbd lease break handling path,
> potentially causing incorrect lease state transitions or new locking issues
> when clients access shared files concurrently over SMB.
>