# CVE-2026-53198: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL

CVE-2026-53198 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-53198, released June 25, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-53198
- Priority: High
- CVSS: 8.8 (Important)
- EPSS: 0.0045
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 25, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53198

## Description

In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL  A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on conn->async_requests via setup_async_work(), with cancel_fn = smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.  When the request is cancelled, the worker frees the file_lock with locks_free_lock() and takes the cancelled early-exit, which "goto out"s and never reaches release_async_work() -- the only site that unlinks the work from conn->async_requests and clears cancel_fn/cancel_argv. The work therefore stays matchable on async_requests with a live cancel_fn pointing at the freed file_lock, until connection teardown finally runs release_async_work().  smb2_cancel() fires cancel_fn unconditionally with no state guard, so a second SMB2_CANCEL for the same AsyncId, arriving in that window, re-runs smb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free:    BUG: KASAN: slab-use-after-free in __locks_delete_block     __locks_delete_block     locks_delete_block     ksmbd_vfs_posix_lock_unblock     smb2_remove_blocked_lock     smb2_cancel                 <- 2nd SMB2_CANCEL fires cancel_fn     handle_ksmbd_work   Allocated by ...: locks_alloc_lock <- smb2_lock   Freed by ...:     locks_free_lock  <- smb2_lock (cancelled branch)   ... cache file_lock_cache of size 192  Reproduced on mainline with KASAN by an authenticated SMB client.  Skip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback cannot be fired a second time.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.176-1 | [DEBIAN-CVE-2026-53198](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53198.md) | Jun 25, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.94-1 | [DEBIAN-CVE-2026-53198](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53198.md) | Jun 25, 2026 |
| Linux | linux Debian 14 | 7.0.13-1 | [DEBIAN-CVE-2026-53198](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53198.md) | Jun 25, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.