CVE-2026-90174
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A slab-out-of-bounds read vulnerability exists in the ksmbd module of the Linux kernel in the ksmbd_alloc_user() function. The function copies resp->hash_sz bytes from the mountd IPC login response, where hash_sz is a __u16 supplied by the response and is not validated against the size of the hash[] buffer (KSMBD_REQ_MAX_HASH_SZ). A malformed or malicious login response can set hash_sz up to 65535, causing the memcpy() to read past the end of the response object.
Risk Assessment
The vulnerability can lead to kernel memory disclosure or system crash (kernel panic) via an out-of-bounds read. However, it requires the ability to supply a malicious login response via IPC, limiting the attack vector to environments with access to this mechanism.
Recommendation
Update the Linux kernel to a version containing the fix that rejects responses with hash_sz exceeding the on-stack hash[] buffer size before allocating and copying. If updating is not possible, restrict access to the ksmbd service to trusted networks.
Other vulnerabilities in Linux kernel (ksmbd)
See all- CVE-2026-90175Unknown
In the Linux kernel's SMB server (ksmbd), the buffer returned by ksmbd_ipc_login_request_ext() was not freed after ksmbd_alloc_user() calls, causing a memory leak visible in kmemleak. The fix frees this buffer unconditionally.
- CVE-2026-90170Unknown
In the Linux kernel's ksmbd module, ipc_validate_msg() reads length fields (payload_sz, session_key_len, ngroups) from the response buffer supplied by the userspace ksmbd daemon before verifying the buffer is large enough. A short response causes an out-of-bounds read past the end of the allocation, triggering a KASAN slab-out-of-bounds error.
- CVE-2026-90169Unknown
In the Linux kernel's ksmbd module, preauthentication sessions (preauth_session) were not freed on connection teardown. If a client disconnected before sending the authenticate request, the object allocated during NTLM negotiate was not freed by either the authenticate or error cleanup paths, causing a memory leak.
- CVE-2026-90167Unknown
In the Linux kernel's ksmbd module, close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Without serializing the close transition with bit acquisition, close can become a new break owner through the test_and_set_bit() fast path and overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT, continuing a break for a dying opinfo.
- CVE-2026-90155Unknown
In the ksmbd module of the Linux kernel, a file_lock lifetime flaw exists. Retained file_lock objects can still be part of the VFS blocked-request graph, and freeing them directly triggers BUG_ON(!list_empty(&flc->flc_blocked_requests)) and can leave a freed ksmbd_lock reachable.
- CVE-2026-90154Unknown
In the ksmbd module of the Linux kernel, ksmbd_all_conn_set_status() treats every connection with the transient binding flag set as belonging to the target SessionId. As a result, a logoff or session replacement can move an unrelated connection to NEED_RECONNECT or NEED_SETUP.
- CVE-2026-90152Unknown
In the ksmbd module of the Linux kernel, ksmbd_session_register() fails to remove the session from sessions_table and drop its table reference when xa_store() fails. This causes a session leak because the reference count stays at 1 and the session is not freed.
- CVE-2026-89788Critical
In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.
- CVE-2026-89635Critical
In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.
- CVE-2026-80926Critical
A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() ksmbd_alloc_user() copies resp->hash_sz bytes out of the mountd IPC login response with user->passkey_sz = resp->hash_sz; user->passkey = kmalloc(resp->hash_sz, KSMBD_DEFAULT_GFP); if (user->passkey) memcpy(user->passkey, resp->hash, resp->hash_sz); resp->hash_sz is a __u16 supplied by the response, but resp->hash[] is only KSMBD_REQ_MAX_HASH_SZ bytes. A malformed or malicious login response can set hash_sz well beyond that (up to 65535), so the memcpy() reads past the end of the response object. ipc_validate_msg() does not bound hash_sz, so reject any response whose hash_sz exceeds the on-stack hash[] buffer before allocating and copying. [ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbd_alloc_user+0x278/0x680 [ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker/4:1/18611 [ 2030.242296] [ 2030.242710] CPU: 4 UID: 0 PID: 18611 Comm: kworker/4:1 Not tainted 7.1.0-next-20260623-virtme #96 PREEMPT(lazy) [ 2030.242732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 2030.242743] Workqueue: ksmbd-io handle_ksmbd_work [ 2030.242763] Call Trace: [ 2030.242769] <TASK> [ 2030.242776] dump_stack_lvl+0xa2/0xd0 [ 2030.242794] print_address_description+0x77/0x200 [ 2030.242815] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242831] print_report+0x58/0x70 [ 2030.242848] kasan_report+0x117/0x150 [ 2030.242869] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242888] kasan_check_range+0x3c7/0x3f0 [ 2030.242908] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242925] __asan_memcpy+0x29/0x70 [ 2030.242942] ksmbd_alloc_user+0x278/0x680 [ 2030.242960] ksmbd_login_user+0xc3/0x120 [ 2030.242978] ntlm_authenticate+0x5e6/0x1b00 [ 2030.243017] ? __pfx_ntlm_authenticate+0x10/0x10 [ 2030.243035] ? ksmbd_session_lookup+0x188/0x1d0 [ 2030.243054] ? __pfx_ksmbd_session_lookup+0x10/0x10 [ 2030.243090] ? __sanitizer_cov_trace_switch+0x7b/0x140 [ 2030.243108] smb2_sess_setup+0x1e4a/0x27b0 [ 2030.243126] ? copy_from_kernel_nofault+0x199/0x300 [ 2030.243156] ? __pfx_smb2_sess_setup+0x10/0x10 [ 2030.243173] ? get_smb2_cmd_val+0xe3/0x1c0 [ 2030.243208] handle_ksmbd_work+0x954/0x1280 [ 2030.243230] ? __pfx_handle_ksmbd_work+0x10/0x10 [ 2030.243249] ? process_scheduled_works+0xa07/0x1490 [ 2030.243270] ? process_scheduled_works+0xa07/0x1490 [ 2030.243291] process_scheduled_works+0xa70/0x1490 [ 2030.243320] ? __pfx_process_scheduled_works+0x10/0x10 [ 2030.243340] ? do_raw_spin_lock+0x130/0x300 [ 2030.243358] ? lock_is_held_type+0x7b/0x110 [ 2030.243388] worker_thread+0x932/0xe20 [ 2030.243415] kthread+0x38a/0x470 [ 2030.243431] ? __pfx_worker_thread+0x10/0x10 [ 2030.243451] ? __pfx_kthread+0x10/0x10 [ 2030.243467] ret_from_fork+0x484/0x910 [ 2030.243485] ? __pfx_ret_from_fork+0x10/0x10 [ 2030.243501] ? __switch_to+0xc77/0x12c0 [ 2030.243523] ? __pfx_kthread+0x10/0x10 [ 2030.243540] ret_from_fork_asm+0x1a/0x30 [ 2030.243564] </TASK> [ 2030.243570] [ 2030.290164] Allocated by task 19279: [ 2030.290911] kasan_save_track+0x3e/0x80 [ 2030.292179] __kasan_kmalloc+0x72/0x90 [ 2030.293217] __kvmalloc_node_noprof+0x3ff/0x6b0 [ 2030.294467] handle_generic_event+0x59b/0x750 [ 2030.295345] genl_family_rcv_msg_doit+0x238/0x340 [ 2030.296553] genl_rcv_msg+0x606/0x7b0 [ 2030.297129] netlink_rcv_skb+0x22b/0x4a0 [ 2030.298500] genl_rcv+0x2d/0x40 [ 2030.299273] netlink_unicast+0x7ba/0x930 [ 2030.300019] netlink_sendmsg+0x8c3/0xb00 [ 2030.301073] __sock_sendmsg+0xec/0x140 [ 2030.301579] __sys_sendto+0x357/0x470 [ 2030.302255] __x64_sys_sendto+0xe3/0x100 [ 2030.303425] do_syscall_64+0x135/0x460 [ 2030.304763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2030.305594] [ 2030.305819] The buggy address belongs to the object at ffff888121bb6640 [ 2030.305819] which belongs to the cache kmalloc-192 of size 192 [ 2030.309595] The buggy address ---truncated---
Vulnerability data from NVD (NIST) · CISA KEV · EPSS