In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko… (CVE-2026-98897)

The vulnerability in the Linux kernel's ksmbd subsystem involved holding the ci->m_lock read lock while waiting for a lease break acknowledgment in wait_for_break_ack(). When a conflicting open arrived while a cifs.ko client cached a read-handle lease, ksmbd broke the lease and waited for acknowledgment. However, the close path that should have woken the waiter required a write lock on ci->m_lock, which was blocked by the waiting thread's read lock, causing a deadlock resolved only by a 35-second timeout. This led to significant delays in lease break handling and increased test execution times. The fix collects target opinfo references while holding the lock, then releases the lock before breaking leases, avoiding the deadlock by ensuring the lock is not held during the wait.

The vulnerability caused a deadlock condition in the ksmbd lease break handling, resulting in lease break acknowledgments being delayed by up to 35 seconds. This significantly increased operation times in affected scenarios, such as the xfstests generic/001 test, which took approximately 78 seconds with leases enabled compared to about 4 seconds with oplocks only. There is no indication of direct security compromise or exploitation in the wild.

A fix has been implemented in the Linux kernel to resolve this issue by changing the locking strategy during lease break acknowledgment waits. Users should update to the fixed kernel version once available. No additional mitigation is indicated or required beyond applying the official fix.