CVE-2026-90155

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: detach blocked lock requests before freeing

A file_lock retained by ksmbd for byte-range lock bookkeeping can still

be part of the VFS blocked-request graph. In particular, the VFS can

chain a new waiter below an already blocked request through

flc_blocked_requests. The ksmbd_file reference count does not cover that

graph.

Both __ksmbd_close_fd() and the cross-request unlock path free these

retained file_lock objects directly. If a dependent waiter is still

attached, locks_release_private() hits

BUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime

mismatch can leave a freed ksmbd_lock reachable through its request-local

llist.

Detach the file_lock from the blocked-request graph before freeing it in

the close, cross-request unlock, and rollback paths. locks_delete_block()

also wakes requests chained below the object. Remove llist when a

completed lock is published so a globally visible ksmbd_loc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References