{"cve":"CVE-2026-90156","nvd":{"published":"2026-09-17T17:17:08.717","modified":"2026-10-21T13:20:41.230","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: safely discard unregistered deferred locks\n\nWhen vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on\nrollback_list before allocating and registering the asynchronous work.\nIf either operation fails, rollback assumes that smb_lock->conn is\ninitialized and dereferences NULL. The deferred file_lock also remains\nlinked into the VFS blocked-lock state while it is freed.\n\nKeep the lock off rollback_list until async setup succeeds. On setup\nfailures, explicitly unblock and wake the deferred lock before freeing it\nand its ksmbd wrapper.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/054bcca4cd9f00719b01f7108b51a2168fb94f15","https://git.kernel.org/stable/c/52b91bc5253bb83665f3ea70565d0b2487dae643","https://git.kernel.org/stable/c/77413400f083a959724de6f36348c9677ef9873a","https://git.kernel.org/stable/c/d09af9a35ff7b77a950b507133d9092aadbfeff4","https://git.kernel.org/stable/c/ecdcfa15b3d799476c685cecd433ebefc93015c8"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-90156","score":0.00209,"percentile":0.10902,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}