CVE-2026-90174 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and prioritize remediation. The vulnerability can lead to potential denial-of-service (DoS) attacks, elevation of privileges (EoP) attacks, and data breaches or unauthorized access. It is essential for Linux kernel developers and maintainers to review and apply patches, implement bounds checking, and monitor system logs for potential

Why it matters

The CVE-2026-90174 vulnerability in the Linux kernel's ksmbd_alloc_user() function can lead to potential denial-of-service (DoS) attacks, elevation of privileges (EoP) attacks, and data breaches or unauthorized access. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and prioritize remediation.

• Potential denial-of-service (DoS) attacks
• Elevation of privileges (EoP) attacks
• Data breaches or unauthorized access

Technical summary

The ksmbd_alloc_user() function in the Linux kernel is vulnerable to a slab-out-of-bounds read. The function copies a user-supplied hash size into a fixed-size buffer without proper bounds checking, leading to a potential buffer overflow. The issue arises from the lack of validation of the hash size supplied by the response, allowing an attacker to potentially read past the end of the response object. This vulnerability can be addressed by implementing proper bounds checking on the hash size and reviewing system logs for potential exploitation attempts.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Implement bounds checking for the hash size in the ksmbd_alloc_user() function
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was discovered in the Linux kernel's ksmbd_alloc_user() function. A malformed or malicious login response can set hash_sz well beyond the fixed-size buffer, leading to a slab-out-of-bounds read. The bug was identified through a review of the ksmbd_alloc_user() function and associated stack trace analysis. Evidence is based on the supplied source corpus and CVE details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.