CVE-2026-90162 Linux CVE debrief

Who should care

Linux kernel developers, administrators of Linux kernel-based systems, security teams responsible for monitoring and patching Linux kernel vulnerabilities, and operators managing Linux kernel deployments. These stakeholders should assess exposure, review patches, and implement mitigations to prevent potential exploitation of this vulnerability.

Why it matters

This vulnerability requires immediate attention from Linux kernel developers, administrators, and security teams due to its potential for remote code execution or denial of service, and the need for urgent patching or mitigation to prevent exploitation.

• Potential for remote code execution or denial of service
• Need for urgent patching or mitigation to prevent exploitation
• Potential for data corruption or loss due to Double-Free
• Verification of Linux kernel version and patch level required

Technical summary

The Linux kernel's ksmbd implementation did not properly handle mid-batch granted locks in SMB2_LOCK requests. This allowed a concurrent UNLOCK request to free the lock object before the granting thread completed its rollback loop, resulting in a Use-After-Free and Double-Free vulnerability. The issue arises from premature publication of granted locks to connection-wide and file-wide lists. Affected Linux kernel developers and administrators should review and apply patches or mitigations to prevent exploitation. The vulnerability can lead to potential remote code execution or denial of service.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability
• Monitor Linux kernel updates for potential backports of the fix
• Assess exposure of Linux kernel-based systems to this vulnerability
• Verify Linux kernel version and patch level
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Review compensating controls for exposed systems

Evidence notes

The vulnerability was resolved by deferring the publication of granted locks to connection-wide and file-wide lists until after the entire array of lock elements has been processed without error. This change prevents a concurrent UNLOCK request from freeing the lock object before the granting thread completes its rollback loop, thereby eliminating the Use-After-Free and Double-Free vulnerability. Linux kernel developers and security teams should verify the patch level of their systems and assess exposure to this vulnerability. The fix

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.