CVE-2026-90156

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: safely discard unregistered deferred locks

When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on

rollback_list before allocating and registering the asynchronous work.

If either operation fails, rollback assumes that smb_lock->conn is

initialized and dereferences NULL. The deferred file_lock also remains

linked into the VFS blocked-lock state while it is freed.

Keep the lock off rollback_list until async setup succeeds. On setup

failures, explicitly unblock and wake the deferred lock before freeing it

and its ksmbd wrapper.