In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
Two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistentid race the fp->owner.name compare-read in ksmbdvfscomparedurableowner() against the kfree() in ksmbdreopendurablefd()'s reopen-success path. fp->owner.name is a standalone kstrdup() buffer whose lifetime is independent of the fp refcount, and the two sites share no lock: the compare reads the buffer while the reopen frees it, so the strcmp() can dereference freed memory.
Commit 7ce4fc40018d ("ksmbd: fix durable reconnect double-bind race in ksmbdreopendurablefd") made the fp->conn claim atomic under globalft.lock (closing the owner.name double-free and the ksmbd_file write-UAF), but the compare-read versus reopen-free pair was left unserialized.
BUG: KASAN: slab-use-after-free in strcmp+0x2c/0x80 Read of size 1 by task kworker strcmp ksmbdvfscomparedurableowner smb2checkdurableoplock smb2open Freed by task kworker: kfree ksmbdreopendurablefd smb2open Allocated by task kworker: kstrdup sessionfdcheck smb2sessionlogoff The buggy address belongs to the cache kmalloc-8
Serialize both sides of the race with fp->f_lock. The global durable file-table lock still protects the durable reconnect claim, but fp->owner.name is per-open state and does not need to block unrelated durable table lookups or reconnects. The teardown is left at its existing location after the reopen-success point so that an _openid() rollback still retains owner.name for a later legitimate reconnect to verify.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72381.json",
"cna_assigner": "Linux"
}