# CVE-2026-31444: ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

CVE-2026-31444 is fixed in linux on 1 platform by DEBIAN-CVE-2026-31444 (version 6.19.11-1), released May 15, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-31444
- Priority: High
- CVSS: 9.8 (Moderate)
- EPSS: 0.0045
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 22, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31444

## Description

In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()  smb_grant_oplock() has two issues in the oplock publication sequence:  1) opinfo is linked into ci->m_op_list (via opinfo_add) before    add_lease_global_list() is called.  If add_lease_global_list()    fails (kmalloc returns NULL), the error path frees the opinfo    via __free_opinfo() while it is still linked in ci->m_op_list.    Concurrent m_op_list readers (opinfo_get_list, or direct iteration    in smb_break_all_levII_oplock) dereference the freed node.  2) opinfo->o_fp is assigned after add_lease_global_list() publishes    the opinfo on the global lease list.  A concurrent    find_same_lease_key() can walk the lease list and dereference    opinfo->o_fp->f_ci while o_fp is still NULL.  Fix by restructuring the publication sequence to eliminate post-publish failure:  - Set opinfo->o_fp before any list publication (fixes NULL deref). - Preallocate lease_table via alloc_lease_table() before opinfo_add()   so add_lease_global_list() becomes infallible after publication. - Keep the original m_op_list publication order (opinfo_add before   lease list) so concurrent opens via same_client_has_lease() and   opinfo_get_list() still see the in-flight grant. - Use opinfo_put() instead of __free_opinfo() on err_out so that   the RCU-deferred free path is used.  This also requires splitting add_lease_global_list() to take a preallocated lease_table and changing its return type from int to void, since it can no longer fail.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.19.11-1 | [DEBIAN-CVE-2026-31444](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31444.md) | May 15, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.