Executive brief
The Linux kernel's ksmbd SMB server component has an initialization defect where a failed setup of performance monitoring counters is not properly detected, allowing the server to start in a broken state. This can lead to kernel crashes and corruption of the /proc filesystem when the server begins handling requests, potentially disrupting service availability.
Technical details
The vulnerability is a missing error-check in the initialization path of the ksmbd (kernel SMB daemon) server. The ksmbd_proc_init() function previously returned void but could fail when allocating procfs directories or per-CPU counters on multi-processor systems. After a failure, ksmbd_server_init() continued execution without validating success, leaving NULL pointer references in the proc counter structure. When userspace later initiates the server and calls ksmbd_proc_reset(), a NULL pointer dereference occurs at percpu_counter_set(). Additionally, proc entries may be created in the root /proc directory instead of the ksmbd-specific directory, and cannot be properly cleaned up. The fix changes ksmbd_proc_init() to return an int error code and updates ksmbd_server_init() to check the return value and abort initialization on failure.
Affected products
- Linux Linux Kernel Linux kernel versions containing ksmbd (approximately 5.15 through 6.x and later, prior to the fix commit db97f3763727d652112ae70038d4e17b3ce277bb)
Timeline
- 2026-09-17: disclosed: CVE-2026-90164 published
- 2026-08-17: patched: Upstream fix committed by Namjae Jeon
- 2026-09-14: patched: Fix included in stable kernel releases