CVE-2026-45924 Linux CVE debrief

Who should care

System administrators running Linux kernels with ksmbd (kernel SMB server) enabled; security teams tracking kernel SMB implementation vulnerabilities; organizations using ksmbd for file sharing services who need to ensure service availability

Technical summary

The ksmbd kernel SMB server contains a resource management flaw where two error paths fail to invoke ksmbd_vfs_kern_path_end_removing() after successful calls to ksmbd_vfs_kern_path_start_removing(). This omission leaves inode locks held and references unreleased, causing lock imbalance detected by the kernel's lock debugging infrastructure. The bug triggers 'workqueue leaked lock or atomic' warnings with stack traces showing ksmbd_vfs_kern_path_locked holding sb_writers and i_mutex_dir_key locks. While the immediate symptom is a warning, the underlying unbalanced locking can lead to deadlocks affecting SMB server availability. The vulnerability is local in nature (requires SMB operations that trigger the error paths) and affects systems with ksmbd enabled. Multiple stable kernel branches have received backports of the fix.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates from your Linux distribution that include the ksmbd fix for CVE-2026-45924
• If running custom kernels with ksmbd enabled, cherry-pick the appropriate stable branch commit for your kernel version
• Monitor kernel logs for 'workqueue leaked lock or atomic' messages indicating potential trigger of this bug
• Consider temporarily disabling ksmbd if patches are unavailable and the SMB server functionality is not critical
• Review ksmbd error handling paths if maintaining out-of-tree ksmbd patches

Evidence notes

The CVE description confirms the vulnerability exists in ksmbd, the kernel SMB server. The fix involves adding missing calls to ksmbd_vfs_kern_path_end_removing() on two error paths to properly balance lock acquisition and reference counting. Kernel log evidence shows the bug manifests as 'workqueue leaked lock or atomic' warnings with 2 locks held (sb_writers and i_mutex_dir_key) in the ksmbd_vfs_kern_path_locked function. Multiple stable kernel commits are referenced, indicating backports to supported kernel versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.