Executive brief
The Linux kernel's SMB server component (ksmbd) contains a flaw in its durable session scavenger cleanup logic. If the scavenger thread fails to start, the code attempts to stop a null or error pointer, potentially causing a kernel crash or undefined behavior. This affects systems using kernel-based SMB/CIFS file sharing.
Technical details
This is a null/invalid pointer dereference vulnerability in the ksmbd durable scavenger subsystem (fs/smb/server/vfs_cache.c). When kthread_run() fails during ksmbd_launch_ksmbd_durable_scavenger(), it returns an ERR_PTR() error code. The code sets durable_scavenger_running to true but fails to reset dh_task to NULL or flip the running flag back to false. Later, when server_ctrl_handle_reset() calls ksmbd_stop_durable_scavenger(), it blindly dereferences the invalid pointer via kthread_stop(), causing a kernel panic or hang. The fix checks IS_ERR() and nullifies dh_task and the running flag on failure. This is a local denial of service (crash) condition; no privilege escalation or data corruption occurs.
Affected products
- Linux Linux kernel before commit bef46b604732d83f8da29f782868de4d25bf972c
Timeline
- 2026-09-17: disclosed: CVE-2026-90165 published
- 2026-09-14: patched: Upstream patch committed (bef46b60...)