CVE-2026-90167

In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.

In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.

A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.

A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.

The ksmbd module in the Linux kernel has a signedness bug in smb_direct_prepare_negotiation(). An unsigned __u32 value from preferred_send_size is cast to a signed int before computing min_t(int, ...), so a malicious value of 0x80000000 is treated as smaller than max_recv_size and used to set the maximum allowed receive size. By sending a second message with a large value (>1420 bytes), the attacker can achieve a heap buffer overflow.

A use-after-free vulnerability exists in the Linux kernel ksmbd module involving the share_conf object in compound requests. smb2_get_ksmbd_tcon() reuses work->tcon without validating tcon->t_state, so after an earlier SMB2_TREE_DISCONNECT frees share_conf, subsequent commands dereference the freed memory.

In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.

An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8 related to the lack of validation of the NetBIOS header's length in relation to SMB header sizes in ksmbd. This leads to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8 related to integer underflow and out-of-bounds read in the deassemble_neg_contexts function in fs/smb/server/smb2pdu.c in ksmbd.