CVE-2026-90156

In the Linux kernel, the ksmbd SMB server left sessions ended by logoff or session replacement in the Expired state with a zero credential expiry, which could retain memory and connection slots. The fix reclaims such sessions in the existing expiration worker and safely removes procfs entries and table references.

In the Linux kernel ksmbd module, connection reference management during session channel registration is flawed. A channel stores only a raw connection pointer, so the connection can be freed while another session reference holder is still accessing it (e.g., during SMB3.1.1 binding or a procfs read).

In the Linux kernel ksmbd module, a deadlock occurs during connection scavenging when session locks are busy. The scavenging worker waits for a session lock held by destroy_previous_session(), which in turn waits behind a writer on conn_list_lock that the worker does not release.

In the Linux kernel ksmbd module, get_file_stream_info() does not reserve space for the terminating UTF-16 unit written by smb_strtoUTF16(). When an entry exactly fills the 448-byte response buffer, the terminator is written two bytes past the allocation.

In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.

In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.

A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.

A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.

The ksmbd module in the Linux kernel has a signedness bug in smb_direct_prepare_negotiation(). An unsigned __u32 value from preferred_send_size is cast to a signed int before computing min_t(int, ...), so a malicious value of 0x80000000 is treated as smaller than max_recv_size and used to set the maximum allowed receive size. By sending a second message with a large value (>1420 bytes), the attacker can achieve a heap buffer overflow.

A use-after-free vulnerability exists in the Linux kernel ksmbd module involving the share_conf object in compound requests. smb2_get_ksmbd_tcon() reuses work->tcon without validating tcon->t_state, so after an earlier SMB2_TREE_DISCONNECT frees share_conf, subsequent commands dereference the freed memory.