UBUNTU-CVE-2026-90164: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit() calls ksmbdprocinit() before creating the remaining proc entries and server subsystems. ksmbdprocinit() tears down partial state on a procfs or percpucounter allocation failure, but returns void, so ksmbdserverinit() continues as if the counters were usable. Once userspace starts the server, serverctrlhandleinit() calls ksmbdprocreset(), which reaches percpucounterset() with a NULL per-CPU counters pointer on SMP systems. The later ksmbdproccreate() calls also receive a NULL parent and may create entries in the /proc root; ksmbdproccleanup() cannot remove those entries because ksmbdprocfs is NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Abort ksmbd server initialization when ksmbd_proc_init() fails, rather than continuing to create proc entries and initialize subsystems with unusable counters.