« Volver al listado

CVE-2026-90155

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: detach blocked lock requests before freeing

A file_lock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flc_blocked_requests. The ksmbd_file reference count does not cover that graph.

Both __ksmbd_close_fd() and the cross-request unlock path free these retained file_lock objects directly. If a dependent waiter is still attached, locks_release_private() hits BUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime mismatch can leave a freed ksmbd_lock reachable through its request-local llist.

Leer descripción completaMostrar menos

Detach the file_lock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locks_delete_block() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbd_lock no longer points into the submitting worker's stack.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90155",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d63528eb0d43c4796c42aad56889dec12cf4e122",
              "lessThan": "514a0b2bc949963497e66cacd433f65dc768a71d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d63528eb0d43c4796c42aad56889dec12cf4e122",
              "lessThan": "215e8816b1ac25176d911abb8704390413ccee4b",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/vfs_cache.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/vfs_cache.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:08.607",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/215e8816b1ac25176d911abb8704390413ccee4b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/514a0b2bc949963497e66cacd433f65dc768a71d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: detach blocked lock requests before freeing\n\nA file_lock retained by ksmbd for byte-range lock bookkeeping can still\nbe part of the VFS blocked-request graph. In particular, the VFS can\nchain a new waiter below an already blocked request through\nflc_blocked_requests. The ksmbd_file reference count does not cover that\ngraph.\n\nBoth __ksmbd_close_fd() and the cross-request unlock path free these\nretained file_lock objects directly. If a dependent waiter is still\nattached, locks_release_private() hits\nBUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime\nmismatch can leave a freed ksmbd_lock reachable through its request-local\nllist.\n\nDetach the file_lock from the blocked-request graph before freeing it in\nthe close, cross-request unlock, and rollback paths. locks_delete_block()\nalso wakes requests chained below the object. Remove llist when a\ncompleted lock is published so a globally visible ksmbd_lock no longer\npoints into the submitting worker's stack."
    }
  ],
  "lastModified": "2026-09-17T17:17:08.607",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}