{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90156 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90156 is a vulnerability in Linux, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90156 and fix it if it is affected.\n\nWhat it is: CVE-2026-90156 is a vulnerability in Linux, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90156 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90156/ (Markdown: https://insights.sbomify.com/CVE-2026-90156/index.md)","id":"CVE-2026-90156","markdown":"https://insights.sbomify.com/CVE-2026-90156/index.md","name":"CVE-2026-90156","record":{"aliases":["AZL-102651","BELL-CVE-2026-90156","DEBIAN-CVE-2026-90156","GHSA-7qq9-mrjw-5hqq","UBUNTU-CVE-2026-90156"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel SMB server","requires_auth":"low_privilege","summary":"A null pointer dereference in the Linux kernel ksmbd module allows remote attackers to cause a denial of service via crafted SMB2 lock requests.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: safely discard unregistered deferred locks\n\nWhen vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on\nrollback_list before allocating and registering the asynchronous work.\nIf either operation fails, rollback assumes that smb_lock-\u003econn is\ninitialized and dereferences NULL. The deferred file_lock also remains\nlinked into the VFS blocked-lock state while it is freed.\n\nKeep the lock off rollback_list until async setup succeeds. On setup\nfailures, explicitly unblock and wake the deferred lock before freeing it\nand its ksmbd wrapper.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ksmbd: safely discard unregistered deferred locks","id":"CVE-2026-90156","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"bpf: Reject negative optlen in cgroup getsockopt hook","id":"CVE-2026-90157"},"packages":[],"prev":{"headline":"ksmbd: detach blocked lock requests before freeing","id":"CVE-2026-90155"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A null pointer dereference in the Linux kernel ksmbd module allows remote attackers to cause a denial of service via crafted SMB2 lock requests.","url":"https://insights.sbomify.com/CVE-2026-90156/"}