# CVE-2026-31477: ksmbd: fix memory leaks and NULL deref in smb2_lock()

CVE-2026-31477 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-31477, released May 15, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-31477
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0048
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 22, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31477

## Description

In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix memory leaks and NULL deref in smb2_lock()  smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl:  1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK    path, goto out leaks smb_lock and its flock because the out:    handler only iterates lock_list and rollback_list, neither of    which contains the detached smb_lock.  2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out    leaks smb_lock and flock for the same reason.  The error code    returned to the dispatcher is also stale.  3) In the rollback path, smb_flock_init() can return NULL on    allocation failure.  The result is dereferenced unconditionally,    causing a kernel NULL pointer dereference.  Add a NULL check to    prevent the crash and clean up the bookkeeping; the VFS lock    itself cannot be rolled back without the allocation and will be    released at file or connection teardown.  Fix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before the if(!rc) check in the UNLOCK branch so all exit paths share one free site, and by freeing smb_lock and flock before goto out in the non-UNLOCK branch.  Propagate the correct error code in both cases. Fix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding a NULL check for locks_free_lock(rlock) in the shared cleanup.  Found via call-graph analysis using sqry.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.170-1 | [DEBIAN-CVE-2026-31477](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31477.md) | May 15, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.85-1 | [DEBIAN-CVE-2026-31477](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31477.md) | May 15, 2026 |
| Linux | linux Debian 14 | 6.19.11-1 | [DEBIAN-CVE-2026-31477](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31477.md) | May 15, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.