In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in __close_file_table_ids()

A ksmbd_file can remain alive after logical close while another session
holds a temporary reference obtained through ksmbd_lookup_fd_inode().
ksmbd_close_fd() currently marks the file closed and drops the idr-owned
reference, but leaves the pointer published in the closing session's idr
until the final reference is dropped.

If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final()
supplies the foreign session's file table to __ksmbd_close_fd(). The object
is then freed without being removed from its owner's idr, and the owner
session later dereferences the stale pointer during file-table teardown.

Remove the volatile id from the owner's idr while ksmbd_close_fd() still
holds that table's lock, and clear volatile_id before dropping
the idr-owned reference. A later foreign final put then only performs
physical destruction and cannot remove the object from the wrong table.

https://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac

https://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd

https://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f

https://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459

https://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"9be4a66f019ea90bd9deca70511f4f9ffebf5c6f","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"cffbdc86393b0235383a20c8c59bc32f16036459","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"e7188199eff46a636f3436356f0aae039be6dd66","versionType":"git","status":"affected"},{"version":"df30cbfd3d8a70e61ce59f63ce5ed2261799ac10","versionType":"git","status":"affected"},{"version":"aaf1d5ebb358f546414965b39da90107a7ca7ce5","versionType":"git","status":"affected"},{"version":"5.15.38","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"5.17.6","lessThan":"5.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc6","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]