VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-90125: Linux kernel · smb: client: fix request buffer leak in smb2_new_read_req()

Source GCVE Database

Compare

Authoritative record:CVE-2026-90125· Medium

Not known to be exploited · fixed in deb6468f4164640e4dc875f008aa449cf55987a5 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 19:18 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in deb6468f4164640e4dc875f008aa449cf55987a5, 58066940076b90c16e821fd6f9767cd979cbdb5e, 12092ed28434bf41e08d41e3c5269eb6b337fc02 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-2f7p-h662-999p

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ bd3dcc6a22a9186ed78da51ce09e889803552189, < deb6468f4164640e4dc875f008aa449cf55987a5	Fixed in deb6468f4164640e4dc875f008aa449cf55987a5
LinuxLinux	Affected ≥ bd3dcc6a22a9186ed78da51ce09e889803552189, < 58066940076b90c16e821fd6f9767cd979cbdb5e	Fixed in 58066940076b90c16e821fd6f9767cd979cbdb5e
LinuxLinux	Affected ≥ bd3dcc6a22a9186ed78da51ce09e889803552189, < 12092ed28434bf41e08d41e3c5269eb6b337fc02	Fixed in 12092ed28434bf41e08d41e3c5269eb6b337fc02
LinuxLinux	Affected ≥ bd3dcc6a22a9186ed78da51ce09e889803552189, < 442c5f1358ced0d4e716778ac06f1e323a7e4f21	Fixed in 442c5f1358ced0d4e716778ac06f1e323a7e4f21
LinuxLinux	Affected ≥ bd3dcc6a22a9186ed78da51ce09e889803552189, < 73f6bdb0380486ab37fe12cd74de20abfaf5d3ae	Fixed in 73f6bdb0380486ab37fe12cd74de20abfaf5d3ae
LinuxLinux	Affected ≥ bd3dcc6a22a9186ed78da51ce09e889803552189, < 38daae149c2102d96833cc6acd79c8f98fcce208	Fixed in 38daae149c2102d96833cc6acd79c8f98fcce208

AI-suggested

If you cannot patch yet, monitoring for excessive memory usage related to SMB client asynchronous reads may help detect exploitation attempts. No other specific mitigations are indicated.

Description

A buffer leak vulnerability exists in the Linux kernel's SMB client asynchronous read path due to improper handling of request buffer allocation failures in smb2_new_read_req(). This leak occurs when memory registration fails, causing allocated buffers not to be released, potentially leading to resource exhaustion over time. The issue affects only the asynchronous SMB2 read operation and does not impact synchronous reads or writes.

Impact

The vulnerability leads to a memory leak in the asynchronous SMB2 read client code path. Repeated failed memory registrations cause buffers to be leaked, which can degrade system stability or exhaust resources over time. There is no indication of direct code execution or privilege escalation. The impact is limited to resource consumption on affected Linux kernel SMB clients.

Summary

The vulnerability in the Linux kernel SMB client arises from smb2_new_read_req() allocating a request buffer that is only assigned to the caller at the end of the function. If memory registration fails (returning -EAGAIN), the function returns early without releasing the allocated buffer, causing a leak. The caller, smb2_async_readv(), skips buffer release on error paths, resulting in repeated leaks on retries. This flaw is limited to the asynchronous read path; synchronous SMB2_read() and write paths are unaffected. The problem was identified during AI-assisted code review and relates to error handling in memory registration and retry logic.

References

Community reviews

Loading reviews…