CVE-2026-90174: ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix slab-out-of-bounds read in ksmbdallocuser()
ksmbdallocuser() copies resp->hashsz bytes out of the mountd IPC login response with
user->passkeysz = resp->hashsz; user->passkey = kmalloc(resp->hashsz, KSMBDDEFAULTGFP); if (user->passkey) memcpy(user->passkey, resp->hash, resp->hashsz);
resp->hashsz is a u16 supplied by the response, but resp->hash[] is only KSMBDREQMAXHASHSZ bytes. A malformed or malicious login response can set hashsz well beyond that (up to 65535), so the memcpy() reads past the end of the response object. ipcvalidatemsg() does not bound hashsz, so reject any response whose hashsz exceeds the on-stack hash[] buffer before allocating and copying.
[ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbdallocuser+0x278/0x680 [ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker/4:1/18611 [ 2030.242296] [ 2030.242710] CPU: 4 UID: 0 PID: 18611 Comm: kworker/4:1 Not tainted 7.1.0-next-20260623-virtme #96 PREEMPT(lazy) [ 2030.242732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 2030.242743] Workqueue: ksmbd-io handleksmbdwork [ 2030.242763] Call Trace: [ 2030.242769] <TASK> [ 2030.242776] dumpstacklvl+0xa2/0xd0 [ 2030.242794] printaddressdescription+0x77/0x200 [ 2030.242815] ? ksmbdallocuser+0x278/0x680 [ 2030.242831] printreport+0x58/0x70 [ 2030.242848] kasanreport+0x117/0x150 [ 2030.242869] ? ksmbdallocuser+0x278/0x680 [ 2030.242888] kasancheckrange+0x3c7/0x3f0 [ 2030.242908] ? ksmbdallocuser+0x278/0x680 [ 2030.242925] asanmemcpy+0x29/0x70 [ 2030.242942] ksmbdallocuser+0x278/0x680 [ 2030.242960] ksmbdloginuser+0xc3/0x120 [ 2030.242978] ntlmauthenticate+0x5e6/0x1b00 [ 2030.243017] ? pfxntlmauthenticate+0x10/0x10 [ 2030.243035] ? ksmbdsessionlookup+0x188/0x1d0 [ 2030.243054] ? pfxksmbdsessionlookup+0x10/0x10 [ 2030.243090] ? sanitizercovtraceswitch+0x7b/0x140 [ 2030.243108] smb2sesssetup+0x1e4a/0x27b0 [ 2030.243126] ? copyfromkernelnofault+0x199/0x300 [ 2030.243156] ? pfxsmb2sesssetup+0x10/0x10 [ 2030.243173] ? getsmb2cmdval+0xe3/0x1c0 [ 2030.243208] handleksmbdwork+0x954/0x1280 [ 2030.243230] ? pfxhandleksmbdwork+0x10/0x10 [ 2030.243249] ? processscheduledworks+0xa07/0x1490 [ 2030.243270] ? processscheduledworks+0xa07/0x1490 [ 2030.243291] processscheduledworks+0xa70/0x1490 [ 2030.243320] ? pfxprocessscheduledworks+0x10/0x10 [ 2030.243340] ? dorawspinlock+0x130/0x300 [ 2030.243358] ? lockisheldtype+0x7b/0x110 [ 2030.243388] workerthread+0x932/0xe20 [ 2030.243415] kthread+0x38a/0x470 [ 2030.243431] ? pfxworkerthread+0x10/0x10 [ 2030.243451] ? pfxkthread+0x10/0x10 [ 2030.243467] retfromfork+0x484/0x910 [ 2030.243485] ? pfxretfromfork+0x10/0x10 [ 2030.243501] ? switchto+0xc77/0x12c0 [ 2030.243523] ? pfxkthread+0x10/0x10 [ 2030.243540] retfromforkasm+0x1a/0x30 [ 2030.243564] </TASK> [ 2030.243570] [ 2030.290164] Allocated by task 19279: [ 2030.290911] kasansavetrack+0x3e/0x80 [ 2030.292179] kasankmalloc+0x72/0x90 [ 2030.293217] kvmallocnodenoprof+0x3ff/0x6b0 [ 2030.294467] handlegenericevent+0x59b/0x750 [ 2030.295345] genlfamilyrcvmsgdoit+0x238/0x340 [ 2030.296553] genlrcvmsg+0x606/0x7b0 [ 2030.297129] netlinkrcvskb+0x22b/0x4a0 [ 2030.298500] genlrcv+0x2d/0x40 [ 2030.299273] netlinkunicast+0x7ba/0x930 [ 2030.300019] netlinksendmsg+0x8c3/0xb00 [ 2030.301073] socksendmsg+0xec/0x140 [ 2030.301579] syssendto+0x357/0x470 [ 2030.302255] x64syssendto+0xe3/0x100 [ 2030.303425] dosyscall64+0x135/0x460 [ 2030.304763] entrySYSCALL64afterhwframe+0x77/0x7f [ 2030.305594] [ 2030.305819] The buggy address belongs to the object at ffff888121bb6640 [ 2030.305819] which belongs to the cache kmalloc-192 of size 192 [ 2030.309595] The buggy address ---truncated---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In ksmbd's ipc_validate_msg(), reject any mountd IPC login response whose hash_sz exceeds the on-stack resp->hash[] buffer size, KSMBD_REQ_MAX_HASH_SZ, before allocating or copying the hash.
Event History
Frequently Asked Questions
What input must an attacker influence to trigger the out-of-bounds read?
An attacker needs to cause a malformed or malicious mountd IPC login response with a hash_sz value larger than the fixed hash[] buffer. The value is a 16-bit field and can be set as high as 65535.
Does the existing IPC message validation prevent this condition?
No. ipc_validate_msg() does not impose a bound on hash_sz, so it does not stop an oversized value from reaching the allocation and memcpy operations.
How can I recognize this issue in diagnostics?
KASAN may report a slab-out-of-bounds read in ksmbd_alloc_user(). The supplied example shows a read of size 65535 by a kworker task.
What is the relevant remediation behavior?
The login response must be rejected when hash_sz exceeds the size of the on-stack hash[] buffer, before memory is allocated or data is copied.