ACK: [SRU][J][PATCH 0/1] CVE-2026-43378

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 17:06, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43378
>
> [ Impact ]
>
> A use-after-free vulnerability exists in the ksmbd SMB server in smb2_open().
> The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced
> after rcu_read_unlock(), creating a use-after-free window where the object may
> have already been freed. With a CVSS score of 9.8, this flaw could allow a
> remote attacker to crash the server or potentially execute arbitrary code in
> the kernel context.
>
> [ Fix ]
>
> jammy: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> An incorrect fix in the ksmbd SMB server could affect RCU-protected access to
> oplock information during file open operations, potentially leading to
> incorrect oplock handling, data corruption, or new crashes for clients using
> SMB shares served by ksmbd.
>