CVE-2026-90164 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
smb/server: abort initialization when proc setup fails
ksmbd_server_init() calls ksmbd_proc_init() before creating the remaining proc entries and server subsystems. ksmbd_proc_init() tears down partial state on a procfs or percpu_counter allocation failure, but returns void, so ksmbd_server_init() continues as if the counters were usable.
Once userspace starts the server, server_ctrl_handle_init() calls ksmbd_proc_reset(), which reaches percpu_counter_set() with a NULL per-CPU counters pointer on SMP systems. The later ksmbd_proc_create() calls also receive a NULL parent and may create entries in the /proc root; ksmbd_proc_cleanup() cannot remove those entries because ksmbd_proc_fs is NULL.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the Linux kernel's smb/server component, specifically affecting the ksmbd implementation, stems from an improper error handling sequence during server initialization. The core technical flaw lies in the interaction between ksmbd_server_init and ksmbd_proc_init. During the startup phase, ksmbd_server_init invokes ksmbd_proc_init to establish necessary proc filesystem entries and per-CPU counters required for operational monitoring and control. However, while ksmbd_proc_init correctly attempts to tear down partial state in the event of a failure such as a procfs or percpu_counter allocation error, it returns void rather than an error code. This design oversight causes ksmbd_server_init to proceed with subsequent initialization steps under the false assumption that all prerequisite subsystems are fully functional and allocated. Consequently, critical data structures remain uninitialized or null when they should contain valid pointers, creating a latent defect in the server's internal state management.
The operational impact of this flaw manifests once userspace initiates the ksmbd service through the server control interface. Specifically, the function server_ctrl_handle_init triggers a call to ksmbd_proc_reset, which attempts to reset per-CPU counters using percpu_counter_set. On symmetric multiprocessing systems where multiple CPUs are active, this operation dereferences a NULL pointer because the underlying counter structures were never successfully allocated due to the earlier silent failure. This results in a kernel panic or system crash, effectively causing a denial of service for any host running the affected ksmbd configuration. Furthermore, subsequent calls to ksmbd_proc_create may proceed with a NULL parent directory reference, potentially leading to the creation of proc entries directly under the /proc root namespace rather than within the intended isolated subsystem directory. This not only pollutes the global process filesystem hierarchy but also introduces further instability as ksmbd_proc_cleanup later fails to remove these erroneously created entries because the primary fs structure remains NULL.
From a security classification perspective, this vulnerability aligns with CWE-252, which describes unchecked return values leading to improper error handling, and CWE-476, pertaining to NULL pointer dereferences that result in crashes or denial of service conditions. In terms of adversary behavior mapping under the MITRE ATT&CK framework, while this is primarily a stability issue rather than an exploit vector for privilege escalation, it represents a potential availability impact consistent with resource exhaustion or system crash scenarios often observed in Denial of Service attacks. The lack of robust validation during initialization allows minor allocation failures to cascade into critical runtime faults, undermining the reliability and resilience of the SMB server implementation on Linux systems.
To mitigate this vulnerability, developers must modify ksmbd_proc_init to return an integer error code instead of void, allowing callers like ksmbd_server_init to detect failure conditions explicitly. Upon detecting a non-zero return value from proc initialization routines, the server init sequence should abort immediately and clean up any partially allocated resources before returning control to userspace or failing gracefully. Additionally, defensive programming practices such as null pointer checks in functions like percpu_counter_set and ksmbd_proc_create are essential to prevent dereferencing invalid memory addresses even if state inconsistencies occur due to other causes. Ensuring that cleanup routines verify the validity of parent directories and fs structures before attempting removal operations will further harden the subsystem against edge cases during both initialization and teardown phases, thereby maintaining system stability under resource-constrained or error-prone conditions.