ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
In the Linux kernel, the following vulnerability has been resolved: ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths There are two places where ksmbd_vfs_kern_path_end_removing() needs to be called in order to balance what the corresponding successful call to ksmbd_vfs_kern_path_start_removing() has done, i.e. drop inode locks and put the taken references. Otherwise there might be potential deadlocks and unbalanced locks which are caught like: BUG: workqueue leaked lock or atomic: kworker/5:21/0x00000000/7596 last function: handle_ksmbd_work 2 locks held by kworker/5:21/7596: #0: ffff8881051ae448 (sb_writers#3){.+.+}-{0:0}, at: ksmbd_vfs_kern_path_locked+0x142/0x660 #1: ffff888130e966c0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: ksmbd_vfs_kern_path_locked+0x17d/0x660 CPU: 5 PID: 7596 Comm: kworker/5:21 Not tainted 6.1.162-00456-gc29b353f383b #138 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: ksmbd-io handle_ksmbd_work Call Trace: dump_stack_lvl+0x44/0x5b process_one_work.cold+0x57/0x5c worker_thread+0x82/0x600 kthread+0x153/0x190 ret_from_fork+0x22/0x30 Found by Linux Verification Center (linuxtesting.org).
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.15.203, 6.1.167, 6.12.78, 6.18.17, 6.19.4, 6.6.130
- CVEs
- CVE-2026-45924
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 14:21 UTC · Revision 1
Source evidence
ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
core-osv · Original sourcePublished 27 May 2026, 12:17 UTC
In the Linux kernel, the following vulnerability has been resolved: ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths There are two places where ksmbd_vfs_kern_path_end_removing() needs to be called in order to balance what the corresponding successful call to ksmbd_vfs_kern_path_start_removing() has done, i.e. drop inode locks and put the taken references. Otherwise there might be potential deadlocks and unbalanced locks which are caught like: BUG: workqueue leaked lock or atomic: kworker/5:21/0x00000000/7596 last function: handle_ksmbd_work 2 locks held by kworker/5:21/7596: #0: ffff8881051ae448 (sb_writers#3){.+.+}-{0:0}, at: ksmbd_vfs_kern_path_locked+0x142/0x660 #1: ffff888130e966c0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: ksmbd_vfs_kern_path_locked+0x17d/0x660 CPU: 5 PID: 7596 Comm: kworker/5:21 Not tainted 6.1.162-00456-gc29b353f383b #138 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: ksmbd-io handle_ksmbd_work Call Trace: dump_stack_lvl+0x44/0x5b process_one_work.cold+0x57/0x5c worker_thread+0x82/0x600 kthread+0x153/0x190 ret_from_fork+0x22/0x30 Found by Linux Verification Center (linuxtesting.org).
osv:CVE-2026-45924
Kernel
Fixed versions: 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.17, 6.19.4
Complete source record
{
"id": "1a34b8fe07e288dac79c33401c7155b0fb3a510bae18fde3cce95113adaf4eaf",
"url": "https://osv.dev/vulnerability/CVE-2026-45924",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths",
"summary": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths There are two places where ksmbd_vfs_kern_path_end_removing() needs to be called in order to balance what the corresponding successful call to ksmbd_vfs_kern_path_start_removing() has done, i.e. drop inode locks and put the taken references. Otherwise there might be potential deadlocks and unbalanced locks which are caught like: BUG: workqueue leaked lock or atomic: kworker/5:21/0x00000000/7596 last function: handle_ksmbd_work 2 locks held by kworker/5:21/7596: #0: ffff8881051ae448 (sb_writers#3){.+.+}-{0:0}, at: ksmbd_vfs_kern_path_locked+0x142/0x660 #1: ffff888130e966c0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: ksmbd_vfs_kern_path_locked+0x17d/0x660 CPU: 5 PID: 7596 Comm: kworker/5:21 Not tainted 6.1.162-00456-gc29b353f383b #138 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: ksmbd-io handle_ksmbd_work Call Trace: dump_stack_lvl+0x44/0x5b process_one_work.cold+0x57/0x5c worker_thread+0x82/0x600 kthread+0x153/0x190 ret_from_fork+0x22/0x30 Found by Linux Verification Center (linuxtesting.org).",
"evidence": "osv:CVE-2026-45924",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.15.203",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.167",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.130",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.78",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.17",
"evidence": "/affected/1/ranges"
},
{
"value": "6.19.4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-45924",
"aliases": [
"CVE-2026-45924"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "9d5012ffe14120f978ee34aef4df3d6cb026b7c4"
},
{
"fixed": "8e3a3192ef78d8302916408d62813b1fddfc8972"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ac98d54630d5b52e3f684d872f0d82c06c418ea9"
},
{
"fixed": "f221baa80e5959a0c08a7e34abbf2a4d3cf0e1c2"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "1e858a7a51c7b8b009d8f246de7ceb7743b44a71"
},
{
"fixed": "cf29329a13df79c198b45dfc92577638d30b56fa"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "814cfdb6358d9b84fcbec9918c8f938cc096a43a"
},
{
"fixed": "34d6691933682f0516259a31b39d2cebcedec0a5"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694"
},
{
"fixed": "0c578e8065c4b08d5635a4cbc0f6321df9d20f79"
},
{
"fixed": "4c38600feb81c670edb82e49d201d3d2d00cd4c3"
},
{
"fixed": "a09dc10d1353f0e92c21eae2a79af1c2b1ddcde8"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.190"
},
{
"fixed": "5.15.203"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.149"
},
{
"fixed": "6.1.167"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.103"
},
{
"fixed": "6.6.130"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.43"
},
{
"fixed": "6.12.78"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.15.11"
},
{
"fixed": "6.16"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.16.2"
},
{
"fixed": "6.17"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a7dddd62578c2eb6cb28b8835556a121b5157323"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a726fef6d7d4cfc365d3434e3916dbfe78991a33"
}
]
}
],
"versions": [
"v5.15.202",
"v5.15.201",
"v5.15.200",
"v5.15.199",
"v5.15.198",
"v5.15.197",
"v5.15.196",
"v5.15.195",
"v5.15.194",
"v5.15.193",
"v5.15.192",
"v5.15.191",
"v5.15.190",
"v6.1.166",
"v6.1.165",
"v6.1.164",
"v6.1.163",
"v6.1.162",
"v6.1.161",
"v6.1.160",
"v6.1.159",
"v6.1.158",
"v6.1.157",
"v6.1.156",
"v6.1.155",
"v6.1.154",
"v6.1.153",
"v6.1.152",
"v6.1.151",
"v6.1.150",
"v6.1.149",
"v6.6.129",
"v6.6.128",
"v6.6.127",
"v6.6.126",
"v6.6.125",
"v6.6.124",
"v6.6.123",
"v6.6.122",
"v6.6.121",
"v6.6.120",
"v6.6.119",
"v6.6.118",
"v6.6.117",
"v6.6.116",
"v6.6.115",
"v6.6.114",
"v6.6.113",
"v6.6.112",
"v6.6.111",
"v6.6.110",
"v6.6.109",
"v6.6.108",
"v6.6.107",
"v6.6.106",
"v6.6.105",
"v6.6.104",
"v6.6.103",
"v6.12.77",
"v6.12.76",
"v6.12.75",
"v6.12.74",
"v6.12.73",
"v6.12.72",
"v6.12.71",
"v6.12.70",
"v6.12.69",
"v6.12.68",
"v6.12.67",
"v6.12.66",
"v6.12.65",
"v6.12.64",
"v6.12.63",
"v6.12.62",
"v6.12.61",
"v6.12.60",
"v6.12.59",
"v6.12.58",
"v6.12.57",
"v6.12.56",
"v6.12.55",
"v6.12.54",
"v6.12.53",
"v6.12.52",
"v6.12.51",
"v6.12.50",
"v6.12.49",
"v6.12.48",
"v6.12.47",
"v6.12.46",
"v6.12.45",
"v6.12.44",
"v6.12.43",
"v6.15.11",
"v6.16.12",
"v6.16.11",
"v6.16.10",
"v6.16.9",
"v6.16.8",
"v6.16.7",
"v6.16.6",
"v6.16.5",
"v6.16.4",
"v6.16.3",
"v6.16.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45924.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.203"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.167"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.130"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.78"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.17"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.17.0"
},
{
"fixed": "6.19.4"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45924.json"
}
}
],
"modified": "2026-10-28T02:30:51.284535499Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0c578e8065c4b08d5635a4cbc0f6321df9d20f79",
"https://git.kernel.org/stable/c/34d6691933682f0516259a31b39d2cebcedec0a5",
"https://git.kernel.org/stable/c/4c38600feb81c670edb82e49d201d3d2d00cd4c3",
"https://git.kernel.org/stable/c/8e3a3192ef78d8302916408d62813b1fddfc8972",
"https://git.kernel.org/stable/c/a09dc10d1353f0e92c21eae2a79af1c2b1ddcde8",
"https://git.kernel.org/stable/c/cf29329a13df79c198b45dfc92577638d30b56fa",
"https://git.kernel.org/stable/c/f221baa80e5959a0c08a7e34abbf2a4d3cf0e1c2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45924.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-45924",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45924.json"
}
},
"related_cves": [
{
"value": "CVE-2026-45924",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 519610,
"published_at": "2026-05-27T12:17:43.229+00:00"
}