CVE-2026-90168 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: retain connection for pending notify work
Deferred CHANGE_NOTIFY work keeps an async message ID after the original request work is released. A durable handle can outlive its connection, so the connection teardown can destroy its async IDA before the handle close releases the pending notify work.
Give the synthetic deferred work a connection reference. Release it after the async ID in ksmbd_free_work_struct(). This keeps the async IDA alive until the deferred work is released, even when the original connection has already left the connection list.
During server shutdown there is no client to receive a cleanup response. Skip the write and only release the pending work.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability described involves a use-after-free condition within the ksmbd component of the Linux kernel, specifically concerning the handling of deferred change notification work items associated with SMB durable handles. This issue arises from an incorrect lifecycle management of connection references when dealing with asynchronous message identifiers that persist beyond the initial request processing phase. In normal operation, clients may establish durable handles to maintain file access across reconnections or network interruptions. When a client requests directory notifications using the CHANGE_NOTIFY command, the server queues this work for deferred execution because notification events are often sporadic and require background monitoring rather than immediate synchronous response.
The core technical flaw lies in how the kernel manages the reference counting of the underlying connection structure during teardown procedures. The original implementation allowed an async message identifier to remain active even after the primary request handling context was released. Crucially, a durable handle can outlive its initial TCP or SMB connection session due to reconnection mechanisms inherent in the SMB protocol. However, when that specific connection is torn down and removed from the global connection list, the kernel incorrectly proceeded to destroy the associated async identifier allocation pool before the pending notify work had actually completed and released its hold on resources. This race condition means that if a deferred notification event triggers after the connection has been logically destroyed but while the handle still exists, the system attempts to access or manipulate memory structures tied to an already freed connection object.
This scenario creates a classic use-after-free vulnerability where kernel code accesses deallocated memory regions. The consequences of such a flaw can range from information disclosure if sensitive data is read from the reused memory space to arbitrary code execution if an attacker can control the contents written into that region before it is reallocated for another purpose. In the context of server infrastructure, this could lead to a kernel panic or system crash due to invalid pointer dereferences, resulting in a denial of service against all users relying on the SMB file sharing services provided by the affected Linux host. The risk is particularly acute during periods of high churn where connections are frequently established and terminated while long-running notification watches remain active.
The remediation strategy implemented addresses this lifecycle mismatch by explicitly retaining a reference to the connection object for synthetic deferred work items. By incrementing the connection's reference count when setting up the pending notify work, the kernel ensures that the underlying data structures remain valid until the asynchronous task completes and calls ksmbd_free_work_struct(). This function is responsible for releasing both the async identifier allocation entry and the retained connection reference in a controlled manner. Additionally, special handling was introduced for server shutdown scenarios where no client exists to receive cleanup responses; in these cases, the system skips writing any final response data and proceeds directly to releasing the pending work structure, thereby preventing potential null pointer dereferences or writes to invalid sockets during termination sequences.
From an industry standard perspective, this vulnerability aligns with CWE-416 Use After Free, which describes situations where a program continues to use a pointer after it has been freed, leading to undefined behavior and security risks. The exploitation vector relates to ATT&CK technique T1059 Command and Scripting Interpreter if the kernel crash leads to system instability that could be leveraged for further attacks in compromised environments, although primarily this is classified under infrastructure-level reliability issues rather than direct user-space exploitation paths. Mitigation involves applying the provided kernel patch which corrects the reference counting logic within ksmbd. System administrators should ensure their Linux distributions are updated with the latest stable kernels containing these fixes to prevent potential denial of service conditions arising from race conditions in SMB notification handling mechanisms.