CVE-2026-90156
N/A
N/A
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: safely discard unregistered deferred locks
When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on rollback_list before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smb_lock->conn is initialized and dereferences NULL. The deferred file_lock also remains linked into the VFS blocked-lock state while it is freed.
Keep the lock off rollback_list until async setup succeeds. On setup failures, explicitly unblock and wake the deferred lock before freeing it and its ksmbd wrapper.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < d09af9a35ff7b77a950b507133d9092aadbfeff4 | affected |
| Linux | Linux | e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 054bcca4cd9f00719b01f7108b51a2168fb94f15 | affected |
| Linux | Linux | 5.15 | affected |
| Linux | Linux | 0 < 5.15 | unaffected |
| Linux | Linux | 7.2.6 <= 7.2.* | unaffected |
| Linux | Linux | 7.3-rc1 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/d09af9a35ff7b77a950b507133d9092aadbfeff4
- https://git.kernel.org/stable/c/054bcca4cd9f00719b01f7108b51a2168fb94f15
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.