ACK: [SRU][Q][PATCH 0/1] CVE-2026-43379

[Jian Hui Lee]

Acked-by: Jian Hui Lee <jianhui.lee at canonical.com>

On Tue, Jun 23, 2026 at 11:35 AM Cengiz Can via kernel-team
<kernel-team at lists.ubuntu.com> wrote:
>
> https://ubuntu.com/security/CVE-2026-43379
>
> [ Impact ]
>
> In ksmbd, smb_lazy_parent_lease_break_close() accesses the opinfo pointer
> obtained via rcu_dereference(fp->f_opinfo) after rcu_read_unlock() has already
> been called. This creates a race condition where a concurrent writer can free
> the memory between the unlock and the subsequent pointer dereferences
> (opinfo->is_lease, etc.), leading to a use-after-free. As ksmbd is an in-kernel
> SMB server processing network requests, this flaw could be triggered remotely
> to corrupt memory or crash the system.
>
> [ Fix ]
>
> questing: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix could affect the ksmbd lease break handling path,
> potentially causing incorrect lease state transitions or new locking issues
> when clients access shared files concurrently over SMB.
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team