CVE-2026-90167

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: serialize oplock close with pending break ownership

close may abort an in-flight oplock break while another breaker already

holds an opinfo reference. Releasing pending_break wakes that waiter, but

without serializing the close transition with bit acquisition it can become

a new break owner through the test_and_set_bit() fast path. It can then

overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for

a dying opinfo.

Make OPLOCK_CLOSING terminal once the opinfo is removed from the inode

list. Serialize that transition, pending_break acquisition, and

OPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses

the race releases its ownership and returns -ENOENT. Explicitly wake

pending_break waiters during close so they can observe the terminal state.

Also prevent ACK and timeout paths from replacing OPLOCK_CLOSING with

OPLOCK_STATE_NONE.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References