CVE-2026-90166 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
See the procedure below:
ksmbd_tree_conn_connect ksmbd_share_config_get share->name = kstrdup() // fail if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) // false // do not check `share->name` ksmbd_ipc_tree_connect_request strlen(share->name) // null-ptr-deref
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified in the SMB server component involves a critical NULL pointer dereference within the function ksmbd_ipc_tree_connect_request. This flaw arises from an incomplete error handling path during the initialization of share configurations, specifically when allocating memory for the share name field. The sequence begins with the invocation of ksmbd_tree_conn_connect, which subsequently calls ksmbd_share_config_get to retrieve or create a configuration structure for a requested SMB share. Within this process, the system attempts to duplicate the string representing the share name using kstrdup. Under conditions where memory allocation fails due to resource exhaustion or other constraints, kstrdup returns NULL instead of a valid pointer.
The core technical flaw lies in the conditional logic that follows the allocation attempt. The code checks whether the KSMBD_SHARE_FLAG_PIPE flag is set on the share configuration object using test_share_config_flag. If this condition evaluates to false, indicating that the resource being accessed is not a named pipe, the execution path proceeds without verifying whether the preceding kstrdup operation succeeded. Consequently, the subsequent call to strlen(share->name) attempts to dereference a NULL pointer because share->name was never successfully allocated and remains null. This results in an immediate kernel panic or crash due to invalid memory access, disrupting the stability of the host system running the SMB server implementation.
From an operational impact perspective, this vulnerability allows for local denial-of-service attacks if an attacker can trigger repeated allocation failures while initiating tree connect requests against non-pipe shares. While remote exploitation is less likely without specific network-level conditions that induce memory pressure, the potential for service disruption remains significant in environments where SMB services are exposed to untrusted networks or high-volume client connections. The lack of defensive programming practices regarding pointer validation after dynamic memory allocation represents a fundamental weakness in software reliability and resilience against resource constraints.
This issue aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities resulting from improper handling of return values for functions that may fail to allocate resources. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Denial of Service (T1499) by causing system instability or service interruption through targeted resource exhaustion and subsequent kernel crashes. Remediation requires implementing robust error checking immediately following memory allocation calls such as kstrdup. Developers must ensure that any function returning a pointer validates the result before proceeding with operations dependent on valid data, thereby preventing dereference of invalid addresses and maintaining system integrity under adverse conditions.