CVE-2026-72492

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in sameclienthas_lease()

sameclienthaslease() returns an opinfo pointer from ci->moplist after dropping ci->mlock without taking a reference.

smbgrantoplock() then dereferences that pointer in copylease() and when checking breakingcnt. A concurrent close can remove the old lease from ci->moplist and drop the last reference before the caller uses the returned pointer, leading to a use-after-free.

Take a reference when sameclienthaslease() selects an existing lease, drop any previous match while scanning, and release the returned reference in smbgrant_oplock() after copying the lease state.