CVE-2026-90155ksmbd: detach blocked lock requests before freeing
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A file_lock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flc_blocked_requests. The ksmbd_file reference count does not cover that graph. Both __ksmbd_close_fd() and the cross-request unlock path free these retained file_lock objects directly. If a dependent waiter is still attached, locks_release_private() hits BUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime mismatch can leave a freed ksmbd_lock reachable through its request-local llist. Detach the file_lock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locks_delete_block() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbd_lock no longer points into the submitting worker's stack.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d63528eb0d43c4796c42aad56889dec12cf4e122 before f77d2accafca529e0ea3f979eb6e6cf1dac05c90; from d63528eb0d43c4796c42aad56889dec12cf4e122 before 514a0b2bc949963497e66cacd433f65dc768a71d; from d63528eb0d43c4796c42aad56889dec12cf4e122 before 215e8816b1ac25176d911abb8704390413ccee4b | CNA record |
References
- https://git.kernel.org/stable/c/f77d2accafca529e0ea3f979eb6e6cf1dac05c90
- https://git.kernel.org/stable/c/514a0b2bc949963497e66cacd433f65dc768a71d
- https://git.kernel.org/stable/c/215e8816b1ac25176d911abb8704390413ccee4b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.