---
id: CVE-2026-90156
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: safely discard unregistered deferred locks

  When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on
  rollback_list before allocating and registerin…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: safely discard unregistered deferred locks

  When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on
  rollback_list before allocating and registerin…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <
    d09af9a35ff7b77a950b507133d9092aadbfeff4
  - >-
    Linux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <
    054bcca4cd9f00719b01f7108b51a2168fb94f15
  - Linux 5.15
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:44.593'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90156'
references:
  - url: 'https://git.kernel.org/stable/c/054bcca4cd9f00719b01f7108b51a2168fb94f15'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d09af9a35ff7b77a950b507133d9092aadbfeff4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00198
epssPercentile: 0.08483
ingestedAt: '2026-09-17T16:21:47.873Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: safely discard unregistered deferred locks

When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on
rollback_list before allocating and registering the asynchronous work.
If either operation fails, rollback assumes that smb_lock->conn is
initialized and dereferences NULL. The deferred file_lock also remains
linked into the VFS blocked-lock state while it is freed.

Keep the lock off rollback_list until async setup succeeds. On setup
failures, explicitly unblock and wake the deferred lock before freeing it
and its ksmbd wrapper.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.