CVE-2026-90174

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()

ksmbd_alloc_user() copies resp->hash_sz bytes out of the mountd IPC

login response with

user->passkey_sz = resp->hash_sz;

user->passkey = kmalloc(resp->hash_sz, KSMBD_DEFAULT_GFP);

if (user->passkey)

memcpy(user->passkey, resp->hash, resp->hash_sz);

resp->hash_sz is a __u16 supplied by the response, but resp->hash[] is

only KSMBD_REQ_MAX_HASH_SZ bytes. A malformed or malicious login

response can set hash_sz well beyond that (up to 65535), so the memcpy()

reads past the end of the response object. ipc_validate_msg() does not

bound hash_sz, so reject any response whose hash_sz exceeds the on-stack

hash[] buffer before allocating and copying.

[ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbd_alloc_user+0x278/0x680

[ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker/4:1/18611

[ 2030.242296]

[ 2030.242710] CPU: 4 UID: 0 PID: 186

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References