CVE-2026-74522

CVE-2026-74522 is officially a use-after-free in ksmbd's file descriptor handling, but treating it as a memory-safety bug misses the real vulnerability. The actual defect is a lock-ownership violation: when ksmbd_close_fd() performs a logical close on behalf of an application, it defers removing the file from the owner's idr table until after releasing the reference. This creates a window where a foreign session can hold the final reference to an object still mapped in the original owner's table. When that foreign holder calls __put_fd_final(), it supplies its own table to the teardown path — but the object was never removed from the owner's idr, leaving a stale pointer that corrupts the owner's data structure during cleanup. The fix addresses this by enforcing a simple contract: the owner must remove the idr entry while holding its own lock, before releasing the reference. This prevents the foreign-holder scenario entirely because the object is no longer in any table when the final put occurs. What you should check: First, verify your ksmbd version includes the commit that moves idr removal earlier in the close sequence — this is the patch that actually fixes the bug, not any memory-safety instrumentation. Second, instrument for the race condition the fix may have introduced: if ksmbd_lookup_fd_inode() can be called on a file that is logically open but has had its idr entry removed, you'll see NOT_FOUND errors in SMB compound operations, lease break handling, or oplock transitions where the application hasn't finalized its intent. This is a different failure mode than the original UAF — a premature NOT_FOUND rather than memory corruption — but it's recoverable whereas the UAF was not. Third, audit your deployment for other ksmbd objects using 'volatile id' patterns. The mechanism exists because SMB sharing semantics require a file reference to sometimes outlive its logical close, but the synchronization contract around this deferral was never consistently enforced. The fix clarifies the contract for this instance; check whether other cross-session reference paths in your ksmbd build have the same structural gap. The foreign-holder trigger requires a specific SMB sequence (temporary reference during lease break acknowledgment, multi-channel state management, or certain rename/delete operations), so the exploit surface is narrower than a pure memory-safety bug — but the corruption potential extends upstream to the owning session's privileged context, which CVSS underweights.

Reviewed through automated stages and approved by a human before publication.