CVE-2026-90174

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds read exists in the ksmbd alloc user() function. The issue occurs because the function uses the hash sz variable, provided by a mountd IPC login response, to determine how many bytes to copy into the user->passkey buffer using memcpy(). Since hash sz is a 16-bit unsigned integer that is not properly bounded by ipc validate msg(), a malicious response can set this value up to 65535, exceeding the actual size of the resp->hash[] buffer and causing the system to read past the end of the response object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.