CVE-2026-90176: ksmbd: Do not skip lock checks for single-byte ranges
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Do not skip lock checks for single-byte ranges
checklockrange() uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range.
The start == end shortcut therefore skips mandatory byte-range lock checks for one-byte reads, writes, copychunk operations and one-byte truncate ranges. A conflicting lock covering that byte is not checked and the operation is allowed to proceed.
Remove the shortcut. The truncate size == inode->isize case is already handled by only calling checklockrange() when the new size differs from the current file size.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel ksmbd SMB server are exposed when they process one-byte reads, writes, copychunk operations, or one-byte truncate ranges that overlap a conflicting byte-range lock.
What must an attacker or client do to exploit the flaw?
The client must issue an affected operation whose range is exactly one byte and targets a byte covered by a conflicting lock. The vulnerable lock-range check treats that valid one-byte range as if it can skip mandatory lock checking.
What is the impact of a successful exploit?
A conflicting byte-range lock is not enforced for the affected one-byte operation, allowing that operation to proceed despite the lock.
How can I tell whether a system is affected?
Review the ksmbd check_lock_range() implementation: affected code has a start == end shortcut that bypasses lock checks. The resolved implementation removes that shortcut.