CVE-2026-90156

ksmbd: safely discard unregistered deferred locks

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: safely discard unregistered deferred locks

When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on rollback_list before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smb_lock->conn is initialized and dereferences NULL. The deferred file_lock also remains linked into the VFS blocked-lock state while it is freed.

Keep the lock off rollback_list until async setup succeeds. On setup failures, explicitly unblock and wake the deferred lock before freeing it and its ksmbd wrapper.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before aaa51ac0d934cb4e2ab96e150fccc934e822009bAffected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before ecdcfa15b3d799476c685cecd433ebefc93015c8Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 77413400f083a959724de6f36348c9677ef9873aAffected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 52b91bc5253bb83665f3ea70565d0b2487dae643Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before d09af9a35ff7b77a950b507133d9092aadbfeff4Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 054bcca4cd9f00719b01f7108b51a2168fb94f15Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before aaa51ac0d934cb4e2ab96e150fccc934e822009bAffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before ecdcfa15b3d799476c685cecd433ebefc93015c8Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 77413400f083a959724de6f36348c9677ef9873aAffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 52b91bc5253bb83665f3ea70565d0b2487dae643Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before d09af9a35ff7b77a950b507133d9092aadbfeff4Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 054bcca4cd9f00719b01f7108b51a2168fb94f15Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.