CVE-2026-90175 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
Free it unconditionally after ksmbd_alloc_user() calls.
kmemleak splat: unreferenced object 0xffff888103b83540 (size 192): comm "pool-0", pid 16970, jiffies 4377290937 hex dump (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 408ccc66): __kvmalloc_node_noprof+0x730/0x920 handle_generic_event+0xec/0x1a0 [ksmbd]
genl_family_rcv_msg_doit+0xe0/0x130 genl_rcv_msg+0x181/0x290 netlink_rcv_skb+0x4f/0x100 genl_rcv+0x28/0x40 netlink_unicast+0x1e6/0x2c0 netlink_sendmsg+0x20a/0x450 ____sys_sendmsg+0x2e8/0x310 ___sys_sendmsg+0x78/0xc0 __sys_sendmsg+0x63/0xc0 do_syscall_64+0xa1/0x670 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's ksmbd server component, which implements the Server Message Block protocol for sharing files and printers over a network, contained a memory management flaw within its authentication handling logic. Specifically, the function responsible for processing login requests allocated an extended IPC login request structure using kmem_cache_alloc or similar allocation mechanisms. The vulnerability arises from an improper resource cleanup path where the allocated buffer was not released under all execution conditions following user account creation attempts. This oversight results in a memory leak that persists as long as the affected kernel module remains loaded and processes are spawned to handle authentication requests.
The technical root cause of this issue is classified as CWE-401, which denotes a missing release of memory after effective allocation. In the context of the ksmbd implementation, when the system attempts to allocate user resources via ksmbd_alloc_user(), it relies on prior data structures such as those returned by ksmbd_ipc_login_request_ext(). If the subsequent steps in the authentication flow encounter an error or follow a specific code path that bypasses the deallocation routine, the memory pointer is lost without being freed. This leads to unreferenced kernel objects accumulating in system memory over time. The kmemleak diagnostic output confirms this behavior by identifying an object of size 192 bytes that remains allocated but unreachable from any active reference count or data structure within the kernel heap.
From a security operations perspective, while this is primarily a reliability and stability issue rather than a direct exploitation vector for privilege escalation, it poses significant operational risks through resource exhaustion. An attacker capable of sending repeated authentication requests to an unpatched ksmbd server can trigger these allocation paths repeatedly without triggering deallocation. This gradual consumption of kernel memory contributes to increased system latency and potentially leads to out-of-memory conditions within the kernel space. Such conditions can cause service degradation for legitimate users or result in a denial of service by exhausting available physical RAM, forcing the operating system to invoke its own aggressive reclaim mechanisms or crash entirely due to allocation failures in critical subsystems.
The vulnerability is associated with network-based interactions involving generic netlink communication channels used by ksmbd to manage internal state and user sessions. In terms of attack taxonomy, this aligns with ATT&CK techniques related to resource hijacking where an adversary consumes system resources to disrupt availability. The stack trace indicates the issue occurs during the handling of general family messages received via netlink sockets, specifically within the context of processing generic events that trigger login request extensions. This places the vulnerability in the realm of input validation and state management errors rather than buffer overflows or injection flaws.
To mitigate this risk, system administrators should apply the kernel update provided by their distribution vendor which includes the fix for ksmbd memory leak handling. The patch ensures unconditional freeing of the ipc_login_request_ext buffer after user allocation calls complete, regardless of whether the subsequent operations succeed or fail. Until patches are applied, limiting network exposure to ports used by SMB and restricting access to trusted networks can reduce the attack surface. Additionally, monitoring kernel logs for kmemleak splats or unusual memory consumption patterns in system services may help detect active exploitation attempts targeting this specific resource exhaustion flaw.