CVE-2026-90164: smb/server: abort initialization when proc setup fails
In the Linux kernel, the following vulnerability has been resolved:
smb/server: abort initialization when proc setup fails
ksmbdserverinit() calls ksmbdprocinit() before creating the remaining proc entries and server subsystems. ksmbdprocinit() tears down partial state on a procfs or percpucounter allocation failure, but returns void, so ksmbdserverinit() continues as if the counters were usable.
Once userspace starts the server, serverctrlhandleinit() calls ksmbdprocreset(), which reaches percpucounterset() with a NULL per-CPU counters pointer on SMP systems. The later ksmbdproccreate() calls also receive a NULL parent and may create entries in the /proc root; ksmbdproccleanup() cannot remove those entries because ksmbdprocfs is NULL.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
Initialization of the ksmbd server must encounter a procfs or per-CPU counter allocation failure during ksmbd_proc_init(). If userspace subsequently starts the server, it can reach a reset path that uses a NULL per-CPU counters pointer on SMP systems.
Which systems are most directly exposed to a crash?
SMP systems are directly affected by the NULL per-CPU counters pointer path, because ksmbd_proc_reset() can call percpu_counter_set() after failed initialization. The issue is relevant when the ksmbd server is initialized and its proc setup has partially failed.
What side effects can indicate partial initialization occurred?
Later proc-entry creation can receive a NULL parent and create entries in the /proc root. Cleanup cannot remove those entries because ksmbd_proc_fs is NULL.
What does the fix change?
The fix makes server initialization abort when proc setup fails, rather than continuing with torn-down or unusable proc state.