CVE-2026-90167 Linux CVE debrief

Who should care

Linux system administrators and users of ksmbd functionality should assess their exposure and apply patches or compensating controls as necessary. This vulnerability could potentially allow an attacker to exploit a race condition in ksmbd. The fix involves serializing the close transition with bit acquisition and setting up OPLOCK_ACK_WAIT with an opinfo state lock. Linux system administrators and users of ksmbd functionality should review and apply the

Why it matters

This vulnerability in the Linux kernel's ksmbd implementation could potentially allow an attacker to exploit a race condition. Linux system administrators and users of ksmbd functionality should assess their exposure and apply patches or compensating controls as necessary.

• Potential exploitation of a race condition in ksmbd
• Need for patching or compensating controls
• Verification of system exposure and logs

Technical summary

The vulnerability exists in the ksmbd implementation in the Linux kernel. An issue with serialization of oplock close with pending break ownership could allow an attacker to exploit a race condition. The fix involves serializing the close transition with bit acquisition and setting up OPLOCK_ACK_WAIT with an opinfo state lock. This vulnerability could potentially allow an attacker to exploit a race condition in ksmbd. Linux system administrators and users of ksmbd functionality should assess their exposure and apply patches or compensating controls as necessary. The fix involves serializing the close transition with bit acquisition and setting up OPLOCK_ACK_WAIT with an opinfo state lock.

Defensive priority

Medium

Recommended defensive actions

• Review and apply patches from the Linux kernel maintainers
• Verify system exposure and apply compensating controls if necessary
• Monitor system logs for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. The vulnerability is in the Linux kernel's ksmbd implementation, and it could potentially allow an attacker to exploit a race condition. The fix involves serializing the close transition with bit acquisition and setting up OPLOCK_ACK_WAIT with an opinfo state lock. The source item and CVE record provide limited information on the affected versions and scope. Def

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.