CVE-2026-90155
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A file_lock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flc_blocked_requests. The ksmbd_file reference count does not cover that graph. Both __ksmbd_close_fd() and the cross-request unlock path free these retained file_lock objects directly. If a dependent waiter is still attached, locks_release_private() hits BUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime mismatch can leave a freed ksmbd_lock reachable through its request-local llist. Detach the file_lock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locks_delete_block() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbd_lock no longer points into the submitting worker's stack.
How to fix
- Linux Linux4e8b69c06bd6583ec11abef4fae50c2c8d5f3679, d20d3f6ad8b0b6f4e1bb32cdf7eca251962e8f04, d31db79cfaa9fce6649772ad279779473ba8aef9, f77d2accafca529e0ea3f979eb6e6cf1dac05c90, 514a0b2bc949963497e66cacd433f65dc768a71d, 215e8816b1ac25176d911abb8704390413ccee4b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | d63528eb0d43c4796c42aad56889dec12cf4e122 ≤ v < 4e8b69c06bd6583ec11abef4fae50c2c8d5f3679, d63528eb0d43c4796c42aad56889dec12cf4e122 ≤ v < d20d3f6ad8b0b6f4e1bb32cdf7eca251962e8f04, d63528eb0d43c4796c42aad56889dec12cf4e122 ≤ v < d31db79cfaa9fce6649772ad279779473ba8aef9, d63528eb0d43c4796c42aad56889dec12cf4e122 ≤ v < f77d2accafca529e0ea3f979eb6e6cf1dac05c90, d63528eb0d43c4796c42aad56889dec12cf4e122 ≤ v < 514a0b2bc949963497e66cacd433f65dc768a71d, d63528eb0d43c4796c42aad56889dec12cf4e122 ≤ v < 215e8816b1ac25176d911abb8704390413ccee4b, 5.15 | 4e8b69c06bd6583ec11abef4fae50c2c8d5f3679, d20d3f6ad8b0b6f4e1bb32cdf7eca251962e8f04, d31db79cfaa9fce6649772ad279779473ba8aef9, f77d2accafca529e0ea3f979eb6e6cf1dac05c90, 514a0b2bc949963497e66cacd433f65dc768a71d, 215e8816b1ac25176d911abb8704390413ccee4b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.