CVE-2026-90156 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: safely discard unregistered deferred locks
When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on rollback_list before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smb_lock->conn is initialized and dereferences NULL. The deferred file_lock also remains linked into the VFS blocked-lock state while it is freed.
Keep the lock off rollback_list until async setup succeeds. On setup failures, explicitly unblock and wake the deferred lock before freeing it and its ksmbd wrapper.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's ksmbd module represents a critical flaw in the handling of asynchronous file locking operations within the Server Message Block protocol implementation. This issue stems from an improper sequence of state management during the initialization of deferred locks, specifically when vfs_lock_file attempts to defer a lock request. In this process, smb2_lock initially places its associated ksmbd_lock structure onto a rollback list before proceeding with the allocation and registration of asynchronous work items designed to handle the locking operation. This ordering creates a race condition or logic error where if either the subsequent allocation or registration steps fail, the system enters an inconsistent state that leads to memory corruption and potential denial of service conditions for affected systems running vulnerable kernel versions.
The core technical flaw lies in the assumption made by the rollback mechanism regarding the initialization status of connection objects within lock structures. When a failure occurs after the ksmbd_lock has been added to the rollback_list, the cleanup routine attempts to dereference smb_lock->conn without verifying that this pointer is valid and initialized. Since the asynchronous setup failed before full initialization could complete, conn remains NULL, resulting in a null pointer dereference. This type of error typically manifests as a kernel panic or system crash, effectively causing a denial of service for any user attempting to perform file locking operations over SMB2 connections on systems with this vulnerability present.
Furthermore, the defect extends beyond simple memory safety issues into state management corruption within the Virtual File System layer. The deferred file_lock remains linked into the VFS blocked-lock state even after it has been freed due to the failed setup process. This dangling reference means that subsequent operations interacting with the VFS lock manager may attempt to access or manipulate a deallocated memory region, leading to undefined behavior, data corruption, or further crashes. Such inconsistencies in kernel object lifecycle management are particularly dangerous as they can be triggered by remote attackers sending malformed SMB2 requests, potentially allowing for local privilege escalation if an attacker can induce specific timing conditions that exploit the race between lock registration and cleanup routines.
From a classification perspective, this vulnerability aligns with CWE-416 Use After Free, where memory is accessed after it has been freed, leading to unpredictable behavior and potential security breaches. Additionally, the null pointer dereference aspect corresponds closely to CWE-476 NULL Pointer Dereference, which compromises system stability by causing abrupt termination of critical kernel processes. In terms of attack vectors, this flaw could be leveraged within the ATT&CK framework under techniques related to Denial of Service or potentially as a precursor for more complex exploitation chains targeting kernel memory integrity. The remote nature of SMB services makes these systems particularly attractive targets for automated scanning and exploitation attempts by malicious actors seeking to disrupt network infrastructure or gain footholds through subsequent privilege escalation exploits.
Mitigation strategies primarily involve applying the upstream Linux kernel patches that correct the ordering of operations during deferred lock setup. Developers must ensure that ksmbd_lock structures are not added to the rollback_list until after asynchronous work allocation and registration have successfully completed, thereby preventing premature cleanup attempts on uninitialized objects. For systems where immediate patching is not feasible, network-level controls such as restricting access to SMB ports or deploying intrusion detection signatures targeting malformed lock requests can provide temporary relief. Organizations should also monitor for kernel panics or unexpected service interruptions related to file sharing services and ensure that all server components are updated with the latest security fixes addressing this specific ksmbd defect. Regular auditing of kernel logs for null pointer exceptions in network subsystems will aid in early detection of exploitation attempts against unpatched systems.