CVE-2026-90169
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauth_session between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates this object and returns STATUS_MORE_PROCESSING_REQUIRED. If the client disconnects before it sends the authenticate request, neither the authenticate nor error cleanup paths free the object. Release any remaining preauthentication sessions when tearing down the connection. Initialize the list when allocating the connection so that this cleanup is safe regardless of the negotiated dialect.
How to fix
- Linux Linux1f60a88b2e0203e50f65b0fb9c32ecb0ae0aa683, effcf48d79d8aa53113d8289e140746f25ceb62c, b62b1ebb25f0a19067ed5b1a86036b2dc98be44f, a41a98ee16ae038751b6639decadaa3ce15ca18a, 8e2ebc77678832e981adc008d25cd8f67d08ebc4, 06c7b1d731bc105a8644f1b70165ba8b9416cbab or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | f5a544e3bab78142207e0242d22442db85ba1eff ≤ v < 1f60a88b2e0203e50f65b0fb9c32ecb0ae0aa683, f5a544e3bab78142207e0242d22442db85ba1eff ≤ v < effcf48d79d8aa53113d8289e140746f25ceb62c, f5a544e3bab78142207e0242d22442db85ba1eff ≤ v < b62b1ebb25f0a19067ed5b1a86036b2dc98be44f, f5a544e3bab78142207e0242d22442db85ba1eff ≤ v < a41a98ee16ae038751b6639decadaa3ce15ca18a, f5a544e3bab78142207e0242d22442db85ba1eff ≤ v < 8e2ebc77678832e981adc008d25cd8f67d08ebc4, f5a544e3bab78142207e0242d22442db85ba1eff ≤ v < 06c7b1d731bc105a8644f1b70165ba8b9416cbab, 5.15 | 1f60a88b2e0203e50f65b0fb9c32ecb0ae0aa683, effcf48d79d8aa53113d8289e140746f25ceb62c, b62b1ebb25f0a19067ed5b1a86036b2dc98be44f, a41a98ee16ae038751b6639decadaa3ce15ca18a, 8e2ebc77678832e981adc008d25cd8f67d08ebc4, 06c7b1d731bc105a8644f1b70165ba8b9416cbab |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.