Look up another CVE · open CVE-2026-90174 in the interactive tracker
CVE-2026-90174
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90174 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ksmbd_alloc_user() copies resp->hash_sz bytes out of the mountd IPC login response with user->passkey_sz = resp->hash_sz; user->passkey = kmalloc(resp->hash_sz, KSMBD_DEFAULT_GFP); if (user->passkey) memcpy(user->passkey, resp->hash, resp->hash_sz); resp->hash_sz is a __u16 supplied by the response, but resp->hash[] is only KSMBD_REQ_MAX_HASH_SZ bytes. A malformed or malicious login response can set hash_sz well beyond that (up to 65535), so the memcpy() reads past the end of the response object. ipc_validate_msg() does not bound hash_sz, so reject any response whose hash_sz exceeds the on-stack hash[] buffer before allocating and copying. [ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbd_alloc_user+0x278/0x680 [ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker/4:1/18611 [ 2030.242296] [ 2030.242710] CPU: 4 UID: 0 PID: 18611 Comm: kworker/4:1 Not tainted 7.1.0-next-20260623-virtme #96 PREEMPT(lazy) [ 2030.242732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 2030.242743] Workqueue: ksmbd-io handle_ksmbd_work [ 2030.242763] Call Trace: [ 2030.242769] <TASK> [ 2030.242776] dump_stack_lvl+0xa2/0xd0 [ 2030.242794] print_address_description+0x77/0x200 [ 2030.242815] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242831] print_report+0x58/0x70 [ 2030.242848] kasan_report+0x117/0x150 [ 2030.242869] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242888] kasan_check_range+0x3c7/0x3f0 [ 2030.242908] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242925] __asan_memcpy+0x29/0x70 [ 2030.242942] ksmbd_alloc_user+0x278/0x680 [ 2030.242960] ksmbd_login_user+0xc3/0x120 [ 2030.242978] ntlm_authenticate+0x5e6/0x1b00 [ 2030.243017] ? __pfx_ntlm_authenticate+0x10/0x10 [ 2030.243035] ? ksmbd_session_lookup+0x188/0x1d0 [ 2030.243054] ? __pfx_ksmbd_session_lookup+0x10/0x10 [ 2030.243090] ? __sanitizer_cov_trace_switch+0x7b/0x140 [ 2030.243108] smb2_sess_setup+0x1e4a/0x27b0 [ 2030.243126] ? copy_from_kernel_nofault+0x199/0x300 [ 2030.243156] ? __pfx_smb2_sess_setup+0x10/0x10 [ 2030.243173] ? get_smb2_cmd_val+0xe3/0x1c0 [ 2030.243208] handle_ksmbd_work+0x954/0x1280 [ 2030.243230] ? __pfx_handle_ksmbd_work+0x10/0x10 [ 2030.243249] ? process_scheduled_works+0xa07/0x1490 [ 2030.243270] ? process_scheduled_works+0xa07/0x1490 [ 2030.243291] process_scheduled_works+0xa70/0x1490 [ 2030.243320] ? __pfx_process_scheduled_works+0x10/0x10 [ 2030.243340] ? do_raw_spin_lock+0x130/0x300 [ 2030.243358] ? lock_is_held_type+0x7b/0x110 [ 2030.243388] worker_thread+0x932/0xe20 [ 2030.243415] kthread+0x38a/0x470 [ 2030.243431] ? __pfx_worker_thread+0x10/0x10 [ 2030.243451] ? __pfx_kthread+0x10/0x10 [ 2030.243467] ret_from_fork+0x484/0x910 [ 2030.243485] ? __pfx_ret_from_fork+0x10/0x10 [ 2030.243501] ? __switch_to+0xc77/0x12c0 [ 2030.243523] ? __pfx_kthread+0x10/0x10 [ 2030.243540] ret_from_fork_asm+0x1a/0x30 [ 2030.243564] </TASK> [ 2030.243570] [ 2030.290164] Allocated by task 19279: [ 2030.290911] kasan_save_track+0x3e/0x80 [ 2030.292179] __kasan_kmalloc+0x72/0x90 [ 2030.293217] __kvmalloc_node_noprof+0x3ff/0x6b0 [ 2030.294467] handle_generic_event+0x59b/0x750 [ 2030.295345] genl_family_rcv_msg_doit+0x238/0x340 [ 2030.296553] genl_rcv_msg+0x606/0x7b0 [ 2030.297129] netlink_rcv_skb+0x22b/0x4a0 [ 2030.298500] genl_rcv+0x2d/0x40 [ 2030.299273] netlink_unicast+0x7ba/0x930 [ 2030.300019] netlink_sendmsg+0x8c3/0xb00 [ 2030.301073] __sock_sendmsg+0xec/0x140 [ 2030.301579] __sys_sendto+0x357/0x470 [ 2030.302255] __x64_sys_sendto+0xe3/0x100 [ 2030.303425] do_syscall_64+0x135/0x460 [ 2030.304763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2030.305594] [ 2030.305819] The buggy address belongs to the object at ffff888121bb6640 [ 2030.305819] which belongs to the cache kmalloc-192 of size 192 [ 2030.309595] The buggy address ---truncated---
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/server/mgmt/user_config.c
- What this is
- KERNEL SMB3 SERVER (KSMBD)MAINTAINERS section matched on fs/smb/server/ · linux-cifs@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.15 | 6.18.57 | 272c05a51285 |
| 5.15 | 7.2.6 | 497c221bf6b2 |
| 5.15 | 7.3 | 7405d0ba2943 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- ksmbd_alloc_user() memcpy()s resp->hash_sz bytes from resp->hash, and that __u16 is a field of the KSMBD_EVENT_LOGIN_RESPONSE copied in handle_generic_event() from a local SMBD_GENL netlink message. SMB2 SESSION_SETUP (smb2_sess_setup → ntlm_authenticate → ksmbd_login_user) only supplies the account name that queues ksmbd_ipc_login_request(); it does not carry hash_sz.
- AC:LAttack complexity, low
- The sender sets hash_sz to any __u16 (up to 65535) in a sizeof(ksmbd_login_response) LOGIN_RESPONSE; ipc_validate_msg() has no KSMBD_EVENT_LOGIN_REQUEST case so it never bounds hash_sz. A matching ipc_ida handle is obtained by sending SESSION_SETUP and answering within the 2s IPC wait, with no uncontrolled race.
- PR:LPrivileges required, low
- handle_generic_event() for KSMBD_EVENT_LOGIN_RESPONSE checks netlink_capable(CAP_NET_ADMIN) only when CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN is set; ksmbd_genl_family is netnsok, the ops lack GENL_ADMIN_PERM, and LOGIN_RESPONSE is not bound to ksmbd_tools_pid. CAP_NET_ADMIN is Low, and builds that disable the check let any local user send it.
- UI:NUser interaction, none
- The attacker can connect to the local ksmbd TCP listener, send SMB2 SESSION_SETUP so ksmbd_ipc_login_request() waits on the handle, and inject the crafted LOGIN_RESPONSE themselves. No other user must log in or otherwise act once ksmbd is running.
- S:UScope, unchanged
- The slab over-read in ksmbd_alloc_user() and any oops of the ksmbd-io worker stay inside the host kernel that runs the SMB server. This is not a VM escape, IOMMU/DMA bypass, or other cross-authority impact.
- C:HConfidentiality impact, high
- memcpy(user->passkey, resp->hash, resp->hash_sz) copies up to 65535 bytes from the 18-byte hash[] (KSMBD_REQ_MAX_HASH_SZ) of a packed ksmbd_login_response into kmalloc(hash_sz), which is an unbounded kernel-heap over-read rather than a few bounded bytes.
- I:NIntegrity impact, none
- kmalloc(resp->hash_sz) sizes the destination to the copy length, so the memcpy is a slab-out-of-bounds read with no OOB write. The LOGIN_RESPONSE sender already supplies uid/gid/account/status without this bug, and NTLM (calc_ntlmv2_hash) only consumes CIFS_ENCPWD_SIZE of passkey.
- A:HAvailability impact, high
- A 65535-byte read from a kmalloc-192 LOGIN_RESPONSE object walks off the slab into unmapped memory and oopses the ksmbd-io worker, matching the KASAN report in ksmbd_alloc_user(). The attacker can repeat SESSION_SETUP plus a crafted LOGIN_RESPONSE to crash the kernel at will.