CVE-2026-90165: smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger()

See the procedure below:

ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun() // fail, dhtask is an ERRPTR()

serverctrlhandlereset ksmbdstopdurablescavenger kthreadstop(serverconf.dhtask) // invalid pointer

Event History

Sep 17, 2026

CVE Published

via MITRE·04:06 PM

Data Sourced

via MITRE·04:06 PM

Description

Frequently Asked Questions

What failure sequence is required to trigger the invalid pointer dereference?

The durable scavenger thread creation must fail, leaving server_conf.dh_task as an ERR_PTR while durable_scavenger_running is set to true. A subsequent server reset then calls kthread_stop on that invalid pointer.

Is the problematic stop path reached after a successful durable scavenger thread launch?

The documented sequence specifically requires kthread_run() to fail. The invalid pointer occurs because the failed thread creation result is retained in dh_task before the reset handling invokes the stop routine.

CVE-2026-90165: smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

Event History

Frequently Asked Questions

What failure sequence is required to trigger the invalid pointer dereference?

Is the problematic stop path reached after a successful durable scavenger thread launch?

Company

Resources

Contact

Frequently Asked Questions

What failure sequence is required to trigger the invalid pointer dereference?

Is the problematic stop path reached after a successful durable scavenger thread launch?