CVE-2026-90175

In the Linux kernel's ksmbd module, ipc_validate_msg() reads length fields (payload_sz, session_key_len, ngroups) from the response buffer supplied by the userspace ksmbd daemon before verifying the buffer is large enough. A short response causes an out-of-bounds read past the end of the allocation, triggering a KASAN slab-out-of-bounds error.

In the Linux kernel's ksmbd module, preauthentication sessions (preauth_session) were not freed on connection teardown. If a client disconnected before sending the authenticate request, the object allocated during NTLM negotiate was not freed by either the authenticate or error cleanup paths, causing a memory leak.

In the Linux kernel's ksmbd module, close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Without serializing the close transition with bit acquisition, close can become a new break owner through the test_and_set_bit() fast path and overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT, continuing a break for a dying opinfo.

In the ksmbd module of the Linux kernel, a file_lock lifetime flaw exists. Retained file_lock objects can still be part of the VFS blocked-request graph, and freeing them directly triggers BUG_ON(!list_empty(&flc->flc_blocked_requests)) and can leave a freed ksmbd_lock reachable.

In the ksmbd module of the Linux kernel, ksmbd_all_conn_set_status() treats every connection with the transient binding flag set as belonging to the target SessionId. As a result, a logoff or session replacement can move an unrelated connection to NEED_RECONNECT or NEED_SETUP.

In the ksmbd module of the Linux kernel, ksmbd_session_register() fails to remove the session from sessions_table and drop its table reference when xa_store() fails. This causes a session leak because the reference count stays at 1 and the session is not freed.

In the Linux kernel, the ksmbd module contains a use-after-free vulnerability in smb2_tree_connect(). A newly created tree connection is published in the session and then used by the handler, while a concurrent session logoff can free the object before the handler finishes.

In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.

A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.

A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.