CVE-2026-90156 Linux CVE debrief

Who should care

Linux kernel users and administrators should assess their exposure and verify system updates. This includes operators managing Linux kernel deployments, vulnerability management teams, and security teams responsible for ensuring the security of Linux-based systems.

Why it matters

CVE-2026-90156 is a vulnerability in the Linux kernel's ksmbd that has been resolved. Linux kernel users should verify their systems are updated with the latest ksmbd patches to prevent potential issues with deferred locks.

• Verification of Linux kernel versions and ksmbd patches is necessary to prevent potential issues.
• System administrators should review configurations for proper handling of deferred locks.

Technical summary

The Linux kernel's ksmbd has a vulnerability that has been resolved, ensuring safer handling of unregistered deferred locks. When vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on rollback_list before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smb_lock->conn is initialized and dereferences NULL. The deferred file_lock also remains linked into the VFS blocked-lock state while it is freed. The fix keeps the lock off rollback_list until async setup succeeds and explicitly unblocks and wakes the deferred lock before freeing it and its ksmbd wrapper.

Defensive priority

Linux kernel users should verify their systems are updated with the latest ksmbd patches to prevent potential issues with deferred locks.

Recommended defensive actions

• Verify Linux kernel versions and apply patches for ksmbd updates.
• Review system configurations for proper handling of deferred locks.
• Monitor system logs for potential issues related to ksmbd and deferred locks.
• Perform vulnerability scanning to identify potentially affected systems.
• Review asset inventory for Linux kernel deployments.
• Establish a change window for remediation of exposed systems.
• Track remediation progress and verify fixes.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its resolution in the Linux kernel. References to kernel.org patches are also provided. Linux kernel users should verify their systems are updated with the latest ksmbd patches to prevent potential issues with deferred locks. The fix ensures that the lock is kept off rollback_list until async setup succeeds and explicitly unblocks and wakes the deferred lock before freeing it and its ksmbd wrapper. Evidence limits are based on CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.