CVE-2026-90166: smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest()
See the procedure below:
ksmbdtreeconnconnect ksmbdshareconfigget share->name = kstrdup() // fail if (!testshareconfigflag(share, KSMBDSHAREFLAGPIPE)) // false // do not check share->name ksmbdipctreeconnectrequest strlen(share->name) // null-ptr-deref
Affected Software
Event History
Frequently Asked Questions
What condition triggers the crash?
The crash occurs when allocation of share->name with kstrdup() fails for a share that is not marked with KSMBD_SHARE_FLAG_PIPE. The subsequent IPC tree-connect request calls strlen() on the null share->name pointer.
What component is involved?
The affected code path is in the Linux kernel SMB server implementation, ksmbd, specifically ksmbd_ipc_tree_connect_request().
How can this be identified in logs or crash diagnostics?
Look for a kernel null-pointer dereference whose stack or faulting path includes ksmbd_ipc_tree_connect_request() and strlen(), following ksmbd_tree_conn_connect() and ksmbd_share_config_get().