CVE-2026-90156

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: safely discard unregistered deferred locks

When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on

rollback_list before allocating and registering the asynchronous work.

If either operation fails, rollback assumes that smb_lock->conn is

initialized and dereferences NULL. The deferred file_lock also remains

linked into the VFS blocked-lock state while it is freed.

Keep the lock off rollback_list until async setup succeeds. On setup

failures, explicitly unblock and wake the deferred lock before freeing it

and its ksmbd wrapper.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References