Linux ksmbd CVE-2026-90162

Requires the target to be running the Linux in-kernel SMB server (ksmbd, CONFIG_SMB_SERVER) with an exported share, and the attacker must be an authenticated SMB user (PR:L) able to issue SMB2_LOCK and UNLOCK requests on the same connection. Exploitation is further limited by a race window: the attacker must trigger a multi-element SMB2_LOCK batch that fails on a later element AND land a concurrent UNLOCK that frees a mid-batch granted lock before the granting thread's rollback loop executes - this timing dependency raises real complexity to AC:H. ksmbd is not enabled by default on most distributions (userspace Samba is far more common), which substantially narrows the exposed population.

The vendor CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates the practical severity on two fronts. First, this is a use-after-free/double-free triggered by a RACE: a concurrent UNLOCK request on the same connection must kfree() a granted ksmbd_lock object in the window before the granting thread walks its rollback_list. Winning that timing window makes real-world complexity AC:H, not AC:L, so my adjusted 3.1 score is closer to ~7.0. Second, the most reliable outcome of a UAF/double-free in kernel is a crash/oops (A:H), while the C:H/I:H claims (kernel memory disclosure or privilege escalation) are theoretically reachable but not demonstrated here - defensible as a ceiling but optimistic. Signals are otherwise weak: no EPSS score, no CISA KEV listing, and no public exploit code are present in the input, meaning this is 'no public exploit identified at time of analysis' rather than an actively exploited priority. The 'Information Disclosure' tag conflicts with the described mechanism (memory-corruption UAF/double-free) and should not be read as confirmed data exposure. Net: a genuine authenticated remote memory-corruption bug worth patching, but far less urgent than the 8.8 number alone implies given race-gated exploitation, niche ksmbd deployment, and no exploitation evidence.

An authenticated SMB user connected to a Linux host running the in-kernel ksmbd server sends a crafted SMB2_LOCK request containing a multi-element lock array where a later element fails validation, then races a concurrent UNLOCK request on the same connection to free a mid-batch granted lock before the rollback loop runs. The resulting use-after-free and double-free on the ksmbd_lock and struct file_lock corrupt kernel memory, most reliably crashing the server (DoS) and potentially enabling further exploitation. No public proof-of-concept is identified in the provided data.