[SRU][J][PATCH 0/1] CVE-2026-43378

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-43378

[ Impact ]

A use-after-free vulnerability exists in the ksmbd SMB server in smb2_open().
The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced
after rcu_read_unlock(), creating a use-after-free window where the object may
have already been freed. With a CVSS score of 9.8, this flaw could allow a
remote attacker to crash the server or potentially execute arbitrary code in
the kernel context.

[ Fix ]

jammy: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

An incorrect fix in the ksmbd SMB server could affect RCU-protected access to
oplock information during file open operations, potentially leading to
incorrect oplock handling, data corruption, or new crashes for clients using
SMB shares served by ksmbd.