CVE-2026-90170

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate ipc response length before dereferencing its fields

ipc_validate_msg() computes the expected message size by reading length

fields out of the response buffer supplied by the userspace ksmbd daemon

(payload_sz, session_key_len, ngroups, ...). Those fields are read before

the buffer is verified to be large enough to contain the struct they belong

to, so a short response makes the read land past the end of the allocation.

handle_response() sizes entry->response purely from the netlink attribute

length (nla_len()) and only guards the leading handle read, so the daemon

can install a response as small as the kmalloc-8 object seen below. When

ipc_msg_send_request() then calls ipc_validate_msg() for a

KSMBD_EVENT_RPC_REQUEST, the cast to struct ksmbd_rpc_command reads

resp->payload_sz at offset 8 of an 8-byte allocation:

[ 3697.841381] ==================================================================

[ 3

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References