The vulnerability (CVE-2026-31718) in the Linux kernel's ksmbd subsystem involves a use-after-free error in the __ksmbd_close_fd() function triggered via the durable scavenger mechanism. When a durable file handle remains after a session disconnect (TCP close without SMB2_LOGOFF), the connection pointer (fp->conn) is set to NULL to preserve the handle for reconnection, but the associated byte-range locks on fp->lock_list are not cleaned up. Subsequently, the durable scavenger thread calls __ksmbd_close_fd(NULL, fp), which attempts to acquire a spinlock on fp->conn->llist_lock, causing a use-after-free since fp->conn is NULL and the original connection object has been freed. The root cause is asymmetric cleanup of lock entries. The fix involves safely skipping clist deletion when the list is empty and fp->conn is NULL, among other lifetime management improvements. The vulnerability affects numerous Linux kernel versions before 6.17.0-1026.26 and specific other builds. The vendor advisory confirms a patch is available, and users must update and reboot to apply it.

Successful exploitation of this vulnerability could lead to a use-after-free condition in the kernel, potentially allowing an attacker to cause system crashes or execute arbitrary code with kernel privileges. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported at this time.

A patch is available and has been released in updated Linux kernel packages. Users should apply the latest kernel updates for their distribution and reboot the system to ensure the fix is active. Due to an ABI change in the kernel update, recompilation and reinstallation of all third-party kernel modules are required. Follow vendor instructions carefully to complete the update process.