UBUNTU-CVE-2026-90174: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser() ksmbdallocuser() copies resp->hashsz bytes out of the mountd IPC login response with user->passkeysz = resp->hashsz; user->passkey = kmalloc(resp->hashsz, KSMBDDEFAULTGFP); if (user->passkey) memcpy(user->passkey, resp->hash, resp->hashsz); resp->hashsz is a u16 supplied by the response, but resp->hash[] is only KSMBDREQMAXHASHSZ bytes. A malformed or malicious login response can set hashsz well beyond that (up to 65535), so the memcpy() reads past the end of the response object. ipcvalidatemsg() does not bound hashsz, so reject any response whose hashsz exceeds the on-stack hash[] buffer before allocating and copying. [ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbdallocuser+0x278/0x680 [ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker/4:1/18611 [ 2030.242296] [ 2030.242710] CPU: 4 UID: 0 PID: 18611 Comm: kworker/4:1 Not tainted 7.1.0-next-20260623-virtme #96 PREEMPT(lazy) [ 2030.242732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 2030.242743] Workqueue: ksmbd-io handleksmbdwork [ 2030.242763] Call Trace: [ 2030.242769] <TASK> [ 2030.242776] dumpstacklvl+0xa2/0xd0 [ 2030.242794] printaddressdescription+0x77/0x200 [ 2030.242815] ? ksmbdallocuser+0x278/0x680 [ 2030.242831] printreport+0x58/0x70 [ 2030.242848] kasanreport+0x117/0x150 [ 2030.242869] ? ksmbdallocuser+0x278/0x680 [ 2030.242888] kasancheckrange+0x3c7/0x3f0 [ 2030.242908] ? ksmbdallocuser+0x278/0x680 [ 2030.242925] asanmemcpy+0x29/0x70 [ 2030.242942] ksmbdallocuser+0x278/0x680 [ 2030.242960] ksmbdloginuser+0xc3/0x120 [ 2030.242978] ntlmauthenticate+0x5e6/0x1b00 [ 2030.243017] ? pfxntlmauthenticate+0x10/0x10 [ 2030.243035] ? ksmbdsessionlookup+0x188/0x1d0 [ 2030.243054] ? pfxksmbdsessionlookup+0x10/0x10 [ 2030.243090] ? sanitizercovtraceswitch+0x7b/0x140 [ 2030.243108] smb2sesssetup+0x1e4a/0x27b0 [ 2030.243126] ? copyfromkernelnofault+0x199/0x300 [ 2030.243156] ? pfxsmb2sesssetup+0x10/0x10 [ 2030.243173] ? getsmb2cmdval+0xe3/0x1c0 [ 2030.243208] handleksmbdwork+0x954/0x1280 [ 2030.243230] ? pfxhandleksmbdwork+0x10/0x10 [ 2030.243249] ? processscheduledworks+0xa07/0x1490 [ 2030.243270] ? processscheduledworks+0xa07/0x1490 [ 2030.243291] processscheduledworks+0xa70/0x1490 [ 2030.243320] ? pfxprocessscheduledworks+0x10/0x10 [ 2030.243340] ? dorawspinlock+0x130/0x300 [ 2030.243358] ? lockisheldtype+0x7b/0x110 [ 2030.243388] workerthread+0x932/0xe20 [ 2030.243415] kthread+0x38a/0x470 [ 2030.243431] ? pfxworkerthread+0x10/0x10 [ 2030.243451] ? pfxkthread+0x10/0x10 [ 2030.243467] retfromfork+0x484/0x910 [ 2030.243485] ? pfxretfromfork+0x10/0x10 [ 2030.243501] ? switchto+0xc77/0x12c0 [ 2030.243523] ? pfxkthread+0x10/0x10 [ 2030.243540] retfromforkasm+0x1a/0x30 [ 2030.243564] </TASK> [ 2030.243570] [ 2030.290164] Allocated by task 19279: [ 2030.290911] kasansavetrack+0x3e/0x80 [ 2030.292179] kasankmalloc+0x72/0x90 [ 2030.293217] kvmallocnodenoprof+0x3ff/0x6b0 [ 2030.294467] handlegenericevent+0x59b/0x750 [ 2030.295345] genlfamilyrcvmsgdoit+0x238/0x340 [ 2030.296553] genlrcvmsg+0x606/0x7b0 [ 2030.297129] netlinkrcvskb+0x22b/0x4a0 [ 2030.298500] genlrcv+0x2d/0x40 [ 2030.299273] netlinkunicast+0x7ba/0x930 [ 2030.300019] netlinksendmsg+0x8c3/0xb00 [ 2030.301073] socksendmsg+0xec/0x140 [ 2030.301579] syssendto+0x357/0x470 [ 2030.302255] x64syssendto+0xe3/0x100 [ 2030.303425] dosyscall64+0x135/0x460 [ 2030.304763] entrySYSCALL64afterhwframe+0x77/0x7f [ 2030.305594] [ 2030.305819] The buggy address belongs to the object at ffff888121bb6640 [ 2030.305819] which belongs to the cache kmalloc-192 of size 192 [ 2030.309595] The buggy address ---truncated---