CVE-2026-90170

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd component where the ipc validate msg() function computes the expected message size by reading length fields from a response buffer supplied by the userspace ksmbd daemon before verifying if the buffer is large enough to contain the structure. This can lead to a slab-out-of-bounds read when a short response is provided, causing the system to read past the end of the memory allocation. Specifically, when ipc msg send request() calls ipc validate msg() for a KSMBD EVENT RPC REQUEST, the cast to struct ksmbd rpc command may read the payload sz variable at an offset that exceeds the allocated buffer size.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.