CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's ksmbd component, specifically related to a use-after-free condition that can occur when a file remains accessible after being logically closed. This flaw can lead to potential memory corruption, allowing an attacker to exploit stale pointers during file-table teardown, which may compromise system stability or security. Organizations utilizing Linux systems with ksmbd should prioritize addressing this vulnerability to mitigate risks associated with file handling and session management.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.