CVE-2026-90156 ksmbd: safely discard unregistered deferred locks
A null pointer dereference in the Linux kernel ksmbd module allows remote attackers to cause a denial of service via crafted SMB2 lock requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90156?
CVE-2026-90156 is a vulnerability in Linux, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: safely discard unregistered deferred locks
When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on rollback_list before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smb_lock->conn is initialized and dereferences NULL. The deferred file_lock also remains linked into the VFS blocked-lock state while it is freed.
Keep the lock off rollback_list until async setup succeeds. On setup failures, explicitly unblock and wake the deferred lock before freeing it and its ksmbd wrapper.
Which versions are affected by CVE-2026-90156?
How do I fix CVE-2026-90156?
Apply the vendor's patch.
Is CVE-2026-90156 being exploited?
There is no known exploitation of CVE-2026-90156 in the wild and no public exploit code.
Sources
Also known as AZL-102651, BELL-CVE-2026-90156, DEBIAN-CVE-2026-90156, GHSA-7qq9-mrjw-5hqq, UBUNTU-CVE-2026-90156.