{"id":"CVE-2026-90167","published":"2026-09-17T17:17:10.097","lastModified":"2026-09-17T17:17:10.097","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: serialize oplock close with pending break ownership\n\nclose may abort an in-flight oplock break while another breaker already\nholds an opinfo reference. Releasing pending_break wakes that waiter, but\nwithout serializing the close transition with bit acquisition it can become\na new break owner through the test_and_set_bit() fast path. It can then\noverwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for\na dying opinfo.\n\nMake OPLOCK_CLOSING terminal once the opinfo is removed from the inode\nlist. Serialize that transition, pending_break acquisition, and\nOPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses\nthe race releases its ownership and returns -ENOENT. Explicitly wake\npending_break waiters during close so they can observe the terminal state.\n\nAlso prevent ACK and timeout paths from replacing OPLOCK_CLOSING with\nOPLOCK_STATE_NONE.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/5f97bac88bfb333f426f01c118b8235e75af8d96","tags":[]},{"url":"https://git.kernel.org/stable/c/b0148dc5625dbfd50596ac63c7487c12e8a8ab03","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}