CVE-2026-90165smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() See the procedure below: ksmbd_launch_ksmbd_durable_scavenger durable_scavenger_running = true server_conf.dh_task = kthread_run() // fail, dh_task is an ERR_PTR() server_ctrl_handle_reset ksmbd_stop_durable_scavenger kthread_stop(server_conf.dh_task) // invalid pointer
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 7f0cb478703cbeaddfe5c9101c5c73cd975d1073 builds before 3f8651f6bb52159c9e23993c77a2b51b9505ad64; from d484d621d40f4a8b8959008802d79bef3609641b before af9cb997d13a17029a0d3863e33f4c837e27a8ae; from d484d621d40f4a8b8959008802d79bef3609641b before b2d78c199dfd983638662ace0612d4fade3dbea1; from d484d621d40f4a8b8959008802d79bef3609641b before a2eb72b4d53bb9d8d6c00f3f794eaccb4b1ce5ed; from d484d621d40f4a8b8959008802d79bef3609641b before bef46b604732d83f8da29f782868de4d25bf972c; from 6.6.142 before 6.6.157 | CNA record |
References
- https://git.kernel.org/stable/c/3f8651f6bb52159c9e23993c77a2b51b9505ad64
- https://git.kernel.org/stable/c/af9cb997d13a17029a0d3863e33f4c837e27a8ae
- https://git.kernel.org/stable/c/b2d78c199dfd983638662ace0612d4fade3dbea1
- https://git.kernel.org/stable/c/a2eb72b4d53bb9d8d6c00f3f794eaccb4b1ce5ed
- https://git.kernel.org/stable/c/bef46b604732d83f8da29f782868de4d25bf972c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.