CVE-2026-90167 (GCVE-0-2026-90167)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-17 16:06
VLAI
Title
ksmbd: serialize oplock close with pending break ownership
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pending_break wakes that waiter, but without serializing the close transition with bit acquisition it can become a new break owner through the test_and_set_bit() fast path. It can then overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for a dying opinfo. Make OPLOCK_CLOSING terminal once the opinfo is removed from the inode list. Serialize that transition, pending_break acquisition, and OPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses the race releases its ownership and returns -ENOENT. Explicitly wake pending_break waiters during close so they can observe the terminal state. Also prevent ACK and timeout paths from replacing OPLOCK_CLOSING with OPLOCK_STATE_NONE.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 5f97bac88bfb333f426f01c118b8235e75af8d96 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < b0148dc5625dbfd50596ac63c7487c12e8a8ab03 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/oplock.c",
            "fs/smb/server/oplock.h",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f97bac88bfb333f426f01c118b8235e75af8d96",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "b0148dc5625dbfd50596ac63c7487c12e8a8ab03",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/oplock.c",
            "fs/smb/server/oplock.h",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: serialize oplock close with pending break ownership\n\nclose may abort an in-flight oplock break while another breaker already\nholds an opinfo reference. Releasing pending_break wakes that waiter, but\nwithout serializing the close transition with bit acquisition it can become\na new break owner through the test_and_set_bit() fast path. It can then\noverwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for\na dying opinfo.\n\nMake OPLOCK_CLOSING terminal once the opinfo is removed from the inode\nlist. Serialize that transition, pending_break acquisition, and\nOPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses\nthe race releases its ownership and returns -ENOENT. Explicitly wake\npending_break waiters during close so they can observe the terminal state.\n\nAlso prevent ACK and timeout paths from replacing OPLOCK_CLOSING with\nOPLOCK_STATE_NONE."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:06:56.507Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f97bac88bfb333f426f01c118b8235e75af8d96"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0148dc5625dbfd50596ac63c7487c12e8a8ab03"
        }
      ],
      "title": "ksmbd: serialize oplock close with pending break ownership",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90167",
    "datePublished": "2026-09-17T16:06:56.507Z",
    "dateReserved": "2026-09-11T19:38:34.790Z",
    "dateUpdated": "2026-09-17T16:06:56.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90167",
      "date": "2026-09-29",
      "epss": "0.00198",
      "percentile": "0.08553"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/oplock.c",
                  "fs/smb/server/oplock.h",
                  "fs/smb/server/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5f97bac88bfb333f426f01c118b8235e75af8d96",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b0148dc5625dbfd50596ac63c7487c12e8a8ab03",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/oplock.c",
                  "fs/smb/server/oplock.h",
                  "fs/smb/server/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: serialize oplock close with pending break ownership\n\nclose may abort an in-flight oplock break while another breaker already\nholds an opinfo reference. Releasing pending_break wakes that waiter, but\nwithout serializing the close transition with bit acquisition it can become\na new break owner through the test_and_set_bit() fast path. It can then\noverwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for\na dying opinfo.\n\nMake OPLOCK_CLOSING terminal once the opinfo is removed from the inode\nlist. Serialize that transition, pending_break acquisition, and\nOPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses\nthe race releases its ownership and returns -ENOENT. Explicitly wake\npending_break waiters during close so they can observe the terminal state.\n\nAlso prevent ACK and timeout paths from replacing OPLOCK_CLOSING with\nOPLOCK_STATE_NONE."
          }
        ],
        "id": "CVE-2026-90167",
        "lastModified": "2026-09-17T17:17:10.097",
        "metrics": {},
        "published": "2026-09-17T17:17:10.097",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5f97bac88bfb333f426f01c118b8235e75af8d96"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b0148dc5625dbfd50596ac63c7487c12e8a8ab03"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:30:05Z",
      "cve": "CVE-2026-90167",
      "id": "CVE-2026-90167",
      "initial_release_date": "2026-09-18T00:20:28Z",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90167",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90167.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.