CVE-2026-90176 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Do not skip lock checks for single-byte ranges
check_lock_range() uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range.
The start == end shortcut therefore skips mandatory byte-range lock checks for one-byte reads, writes, copychunk operations and one-byte truncate ranges. A conflicting lock covering that byte is not checked and the operation is allowed to proceed.
Remove the shortcut. The truncate size == inode->i_size case is already handled by only calling check_lock_range() when the new size differs from the current file size.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The ksmbd component within the Linux kernel, which provides an implementation of the SMB/CIFS server protocol for sharing files and printers over a network, contained a logic error in its mandatory byte-range locking mechanism that allowed unauthorized access to protected data regions. This vulnerability stems from a fundamental misunderstanding of range boundaries in the check_lock_range function, which is designed to operate on inclusive ranges where both start and end offsets define valid bytes within a file. The calling code correctly calculates the end offset by adding the length to the start position and subtracting one, meaning that when the start value equals the end value, it represents a single-byte range rather than an empty or invalid interval. However, the implementation included a shortcut condition that treated any instance where start equaled end as an empty range requiring no further processing. This logical flaw effectively bypassed mandatory lock checks for operations targeting exactly one byte of data.
The operational impact of this vulnerability is significant because it allows clients to perform read, write, copychunk, and truncate operations on single-byte ranges without being subject to the expected access control restrictions enforced by file locks. In a typical SMB environment, applications rely on these mandatory locks to ensure data consistency and prevent race conditions or concurrent modification conflicts. By skipping the lock verification for one-byte accesses, an attacker can potentially overwrite critical metadata, corrupt configuration files, or interfere with application state in ways that would normally be blocked if proper locking were enforced. This undermines the integrity guarantees provided by the SMB protocol's locking semantics and could lead to data corruption or unauthorized privilege escalation depending on how the affected file is utilized by other processes.
From a vulnerability classification perspective, this issue aligns with CWE-841, which describes Improper Enforcement of Behavioral Workflow, as the system failed to enforce the correct sequence of operations regarding lock verification before allowing access. It also relates to CWE-697, Incorrect Comparison, due to the flawed logic in determining whether a range is empty or valid based on start and end values. In terms of attack vectors, this could be leveraged within ATT&CK technique T1083, File and Directory Discovery, if used for reconnaissance, but more critically it facilitates data manipulation akin to T1499, Endpoint Denial of Service, through corruption, or T1562, Impair Defenses, by bypassing security controls. The vulnerability highlights the importance of rigorous boundary condition testing in kernel-level network services where incorrect assumptions about input parameters can lead to significant security gaps.
The resolution involves removing the erroneous shortcut that skipped lock checks for single-byte ranges, ensuring that all byte-range operations undergo proper validation against existing locks regardless of their size. This fix restores the intended behavior where even minimal access attempts are subject to mandatory locking protocols, thereby preserving data integrity and preventing unauthorized modifications. Administrators should ensure that systems running affected versions of the Linux kernel with ksmbd enabled are updated to a patched version as soon as possible. Additionally, organizations relying on SMB file sharing for critical operations should review their lock management strategies and consider implementing additional monitoring or access controls to detect any potential exploitation attempts while patches are being deployed across infrastructure.