UBUNTU-CVE-2026-90156: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile() defers a lock, smb2lock() puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smblock->conn is initialized and dereferences NULL. The deferred filelock also remains linked into the VFS blocked-lock state while it is freed. Keep the lock off rollbacklist until async setup succeeds. On setup failures, explicitly unblock and wake the deferred lock before freeing it and its ksmbd wrapper.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ksmbd smb2_lock() handling, keep the ksmbd_lock off rollback_list until asynchronous setup succeeds; if setup fails, explicitly unblock and wake the deferred lock, unlink its file_lock from the VFS blocked-lock state, and only then free the file_lock and its ksmbd wrapper.
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are listed for this issue?
The listed packages are ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-riscv, ubuntu/linux-gkeop, and ubuntu/linux.
What failure sequence leads to the availability problem?
A file lock must be deferred by vfs_lock_file(), after which asynchronous work allocation or registration fails. The rollback path can then dereference an uninitialized connection pointer, while a freed deferred lock may remain linked in the VFS blocked-lock state.
What access and impact does the supplied severity vector indicate?
The vector indicates a network attack vector, low privileges required, no user interaction, and an additional attack precondition. It indicates high availability impact, with no confidentiality or integrity impact.