CVE-2026-90166

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90166
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90166.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90166
Downstream
Related
Published
2026-09-17T16:06:55Z
Modified
2026-11-01T02:31:01Z
Summary
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
Details

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

See the procedure below:

ksmbd_tree_conn_connect ksmbd_share_config_get share->name = kstrdup() // fail if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) // false // do not check share->name ksmbd_ipc_tree_connect_request strlen(share->name) // null-ptr-deref

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90166.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Fixed
d601be98c9445894c759c28d4a7a52151387f1fb
Fixed
5ffd180307a5ea34dae7f90ff9573ebed6b7fb12
Fixed
4eb74a34ea401abfbbd5991076715dae3de938df
Fixed
8461f27902727ad434375caf13a0100aafc0340f
Fixed
7065d3648b1a48d2c49da3d6364dd3c4d503b10c
Fixed
d2ccf905f47d2344270749f4dfa905afcd3edeb0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90166.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.52
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90166.json"