CVE-2026-90165

smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

See the procedure below:

ksmbd_launch_ksmbd_durable_scavenger
durable_scavenger_running = true
server_conf.dh_task = kthread_run() // fail, dh_task is an ERR_PTR()

server_ctrl_handle_reset
ksmbd_stop_durable_scavenger
kthread_stop(server_conf.dh_task) // invalid pointer

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7f0cb478703cbeaddfe5c9101c5c73cd975d1073`	affected	< 3f8651f6bb52159c9e23993c77a2b51b9505ad64
`d484d621d40f4a8b8959008802d79bef3609641b`	affected	< af9cb997d13a17029a0d3863e33f4c837e27a8ae
`d484d621d40f4a8b8959008802d79bef3609641b`	affected	< b2d78c199dfd983638662ace0612d4fade3dbea1
`d484d621d40f4a8b8959008802d79bef3609641b`	affected	< a2eb72b4d53bb9d8d6c00f3f794eaccb4b1ce5ed
`d484d621d40f4a8b8959008802d79bef3609641b`	affected	< bef46b604732d83f8da29f782868de4d25bf972c
`6.6.142`	affected	< 6.6.157

Linux

affected

Version	Status	Constraints
`6.11`	affected	—
`0`	unaffected	< 6.11
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[7f0cb478703cbeaddfe5c9101c5c73cd975d1073,3f8651f6bb52159c9e23993c77a2b51b9505ad64)`	affected	code_commit	—
`[d484d621d40f4a8b8959008802d79bef3609641b,af9cb997d13a17029a0d3863e33f4c837e27a8ae)`	affected	code_commit	—
`[d484d621d40f4a8b8959008802d79bef3609641b,b2d78c199dfd983638662ace0612d4fade3dbea1)`	affected	code_commit	—
`[d484d621d40f4a8b8959008802d79bef3609641b,a2eb72b4d53bb9d8d6c00f3f794eaccb4b1ce5ed)`	affected	code_commit	—
`[d484d621d40f4a8b8959008802d79bef3609641b,bef46b604732d83f8da29f782868de4d25bf972c)`	affected	code_commit	—
`[6.6.142,6.6.157)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.11`	affected	semver	—
`[0,6.11)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.209% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3f8651f6bb52159c9e23993c77a2b51b9505ad64
https://git.kernel.org/stable/c/a2eb72b4d53bb9d8d6c00f3f794eaccb4b1ce5ed
https://git.kernel.org/stable/c/af9cb997d13a17029a0d3863e33f4c837e27a8ae
https://git.kernel.org/stable/c/b2d78c199dfd983638662ace0612d4fade3dbea1
https://git.kernel.org/stable/c/bef46b604732d83f8da29f782868de4d25bf972c

History

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() See the procedure below: ksmbd_launch_ksmbd_durable_scavenger durable_scavenger_running = true server_conf.dh_task = kthread_run() // fail, dh_task is an ERR_PTR() server_ctrl_handle_reset ksmbd_stop_durable_scavenger kthread_stop(server_conf.dh_task) // invalid pointer
Title		smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3f8651f6bb52159c9e23993c77a2b51b9505ad64 https://git.kernel.org/stable/c/a2eb72b4d53bb9d8d6c00f3f794eaccb4b1ce5ed https://git.kernel.org/stable/c/af9cb997d13a17029a0d3863e33f4c837e27a8ae https://git.kernel.org/stable/c/b2d78c199dfd983638662ace0612d4fade3dbea1 https://git.kernel.org/stable/c/bef46b604732d83f8da29f782868de4d25bf972c