ksmbd: validate ipc response length before dereferencing its fields
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipc_validate_msg() computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon (payload_sz, session_key_len, ngroups, ...). Those fields are read before the buffer is verified to be large enough to contain the struct they belong to, so a short response makes the read land past the end of the allocation. handle_response() sizes entry->response purely from the netlink attribute length (nla_len()) and only guards the leading handle read, so the daemon can install a response as small as the kmalloc-8 object seen below. When ipc_msg_send_request() then calls ipc_validate_msg() for a KSMBD_EVENT_RPC_REQUEST, the cast to struct ksmbd_rpc_command reads resp->payload_sz at offset 8 of an 8-byte allocation: [ 3697.841381] ================================================================== [ 3697.844099] BUG: KASAN: slab-out-of-bounds in ipc_msg_send_request+0x763/0x800 [ 3697.846604] Read of size 4 at addr ffff888105f95910 by task kworker/4:3/20682 [ 3697.849061] [ 3697.849801] CPU: 4 UID: 0 PID: 20682 Comm: kworker/4:3 Not tainted 7.2.0-rc3-next-20260717-virtme #117 PREEMPT(lazy) [ 3697.850077] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 3697.850303] Workqueue: ksmbd-io handle_ksmbd_work [ 3697.850592] Call Trace: [ 3697.850794] [ 3697.
CVE-2026-90170
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90170
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "bf396208418371174869baba9434535cd3288e80",
"lessThan": "17b7d1a2b4d5473df5dca8c9a07d65021806c23a",
"versionType": "git"
},
{
"status": "affected",
"version": "7dd0c858e1909769a4c91842724315ee74f1a5f1",
"lessThan": "398cba4b646a6c08ff3d79e6b1e70e5ddae8a065",
"versionType": "git"
},
{
"status": "affected",
"version": "299db777ea0cfa5c407e41b045c24a14c034c27b",
"lessThan": "0aa8f94bfd4d818284c8a7ce0040d40ca1ec3595",
"versionType": "git"
},
{
"status": "affected",
"version": "d6a6aa81eac2c9bff66dc6e191179cb69a14426b",
"lessThan": "c494fcf8e89e3c970e13d78ebe62bf5d8f2b1c52",
"versionType": "git"
},
{
"status": "affected",
"version": "d6a6aa81eac2c9bff66dc6e191179cb69a14426b",
"lessThan": "e9b33376bd07bca4175f7bcc2d6034ef250f8181",
"versionType": "git"
},
{
"status": "affected",
"version": "99c631d0366c1eab8fb188fe66425f4581ebdde4",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.141",
"lessThan": "6.6.157",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.84",
"lessThan": "6.12.110",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.25",
"lessThan": "6.18.52",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.0.2",
"lessThan": "7.1",
"versionType": "semver"
}
],
"programFiles": [
"fs/smb/server/transport_ipc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/smb/server/transport_ipc.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90170
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #36555 · Revision 1
- Added to Heist Feed
- Publisher date