CVE-2026-90164: smb/server: abort initialization when proc setup fails
In the Linux kernel, the following vulnerability has been resolved:
smb/server: abort initialization when proc setup fails
ksmbdserverinit() calls ksmbdprocinit() before creating the remaining proc entries and server subsystems. ksmbdprocinit() tears down partial state on a procfs or percpucounter allocation failure, but returns void, so ksmbdserverinit() continues as if the counters were usable.
Once userspace starts the server, serverctrlhandleinit() calls ksmbdprocreset(), which reaches percpucounterset() with a NULL per-CPU counters pointer on SMP systems. The later ksmbdproccreate() calls also receive a NULL parent and may create entries in the /proc root; ksmbdproccleanup() cannot remove those entries because ksmbdprocfs is NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
Initialization of the ksmbd server must encounter a procfs or per-CPU counter allocation failure during ksmbd_proc_init(). If userspace subsequently starts the server, it can reach a reset path that uses a NULL per-CPU counters pointer on SMP systems.
Which systems are most directly exposed to a crash?
SMP systems are directly affected by the NULL per-CPU counters pointer path, because ksmbd_proc_reset() can call percpu_counter_set() after failed initialization. The issue is relevant when the ksmbd server is initialized and its proc setup has partially failed.
What side effects can indicate partial initialization occurred?
Later proc-entry creation can receive a NULL parent and create entries in the /proc root. Cleanup cannot remove those entries because ksmbd_proc_fs is NULL.
What does the fix change?
The fix makes server initialization abort when proc setup fails, rather than continuing with torn-down or unusable proc state.