{
  "cveId": "CVE-2026-31444",
  "url": "https://patchblox.com/security/cve/CVE-2026-31444",
  "summary": "CVE-2026-31444 is fixed in linux on 1 platform by DEBIAN-CVE-2026-31444 (version 6.19.11-1), released May 15, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()  smb_grant_oplock() has two issues in the oplock publication sequence:  1) opinfo is linked into ci-\u003Em_op_list (via opinfo_add) before    add_lease_global_list() is called.  If add_lease_global_list()    fails (kmalloc returns NULL), the error path frees the opinfo    via __free_opinfo() while it is still linked in ci-\u003Em_op_list.    Concurrent m_op_list readers (opinfo_get_list, or direct iteration    in smb_break_all_levII_oplock) dereference the freed node.  2) opinfo-\u003Eo_fp is assigned after add_lease_global_list() publishes    the opinfo on the global lease list.  A concurrent    find_same_lease_key() can walk the lease list and dereference    opinfo-\u003Eo_fp-\u003Ef_ci while o_fp is still NULL.  Fix by restructuring the publication sequence to eliminate post-publish failure:  - Set opinfo-\u003Eo_fp before any list publication (fixes NULL deref). - Preallocate lease_table via alloc_lease_table() before opinfo_add()   so add_lease_global_list() becomes infallible after publication. - Keep the original m_op_list publication order (opinfo_add before   lease list) so concurrent opens via same_client_has_lease() and   opinfo_get_list() still see the in-flight grant. - Use opinfo_put() instead of __free_opinfo() on err_out so that   the RCU-deferred free path is used.  This also requires splitting add_lease_global_list() to take a preallocated lease_table and changing its return type from int to void, since it can no longer fail.",
  "published": "2026-04-22T14:16:38Z",
  "severity": "Moderate",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.0045,
  "epssPercentile": 0.39341,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31444",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.19.11-1",
      "fix": "DEBIAN-CVE-2026-31444",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-31444",
      "released": "2026-05-15T16:01:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}