CVE-2026-90170— ksmbd 远程代码执行漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，已修复以下漏洞： ksmbd：在解引用其字段之前，先验证 IPC 响应长度 通过从用户空间 ksmbd 守护进程提供的响应缓冲区中读取长度字段（ 、 、 等）来计算预期消息大小。这些字段是在缓冲区被验证是否足够大以容纳其所属结构体之前就被读取的，因此，如果响应过短，读取操作会落在内存分配的末尾之外。 完全依据 netlink 属性长度（ ）来确定 的大小，并且仅对开头的 handle 读取进行了保护，因此守护进程可以安装一个小到如同下面看到的 对象一样的响应。当 为 调用 时，将响应强制转换
影响版本矩阵 17
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | bf396208418371174869baba9434535cd3288e80< 17b7d1a2b4d5473df5dca8c9a07d65021806c23a |
affected |
7dd0c858e1909769a4c91842724315ee74f1a5f1< 398cba4b646a6c08ff3d79e6b1e70e5ddae8a065 |
affected | ||
299db777ea0cfa5c407e41b045c24a14c034c27b< 0aa8f94bfd4d818284c8a7ce0040d40ca1ec3595 |
affected | ||
d6a6aa81eac2c9bff66dc6e191179cb69a14426b< c494fcf8e89e3c970e13d78ebe62bf5d8f2b1c52 |
affected | ||
d6a6aa81eac2c9bff66dc6e191179cb69a14426b< e9b33376bd07bca4175f7bcc2d6034ef250f8181 |
affected | ||
99c631d0366c1eab8fb188fe66425f4581ebdde4 |
affected | ||
6.6.141< 6.6.157 |
affected | ||
6.12.84< 6.12.110 |
affected | ||
| … +9 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-90170 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
ksmbd: validate ipc response length before dereferencing its fields
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate ipc response length before dereferencing its fields
ipc_validate_msg() computes the expected message size by reading length
fields out of the response buffer supplied by the userspace ksmbd daemon
(payload_sz, session_key_len, ngroups, ...). Those fields are read before
the buffer is verified to be large enough to contain the struct they belong
to, so a short response makes the read land past the end of the allocation.
handle_response() sizes entry->response purely from the netlink attribute
length (nla_len()) and only guards the leading handle read, so the daemon
can install a response as small as the kmalloc-8 object seen below. When
ipc_msg_send_request() then calls ipc_validate_msg() for a
KSMBD_EVENT_RPC_REQUEST, the cast to struct ksmbd_rpc_command reads
resp->payload_sz at offset 8 of an 8-byte allocation:
[ 3697.841381] ==================================================================
[ 3697.844099] BUG: KASAN: slab-out-of-bounds in ipc_msg_send_request+0x763/0x800
[ 3697.846604] Read of size 4 at addr ffff888105f95910 by task kworker/4:3/20682
[ 3697.849061]
[ 3697.849801] CPU: 4 UID: 0 PID: 20682 Comm: kworker/4:3 Not tainted 7.2.0-rc3-next-20260717-virtme #117 PREEMPT(lazy)
[ 3697.850077] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 3697.850303] Workqueue: ksmbd-io handle_ksmbd_work
[ 3697.850592] Call Trace:
[ 3697.850794] <TASK>
[ 3697.850952] __dump_stack+0x21/0x60
[ 3697.851239] dump_stack_lvl+0xc2/0x100
[ 3697.851528] print_address_description+0x77/0x200
[ 3697.851816] ? ipc_msg_send_request+0x763/0x800
[ 3697.852024] print_report+0x58/0x70
[ 3697.852316] kasan_report+0x117/0x150
[ 3697.852585] ? down_write+0x146/0x1f0
[ 3697.852809] ? ipc_msg_send_request+0x763/0x800
[ 3697.853082] ipc_msg_send_request+0x763/0x800
[ 3697.853385] ? __pfx_ipc_msg_send_request+0x10/0x10
[ 3697.853604] ? kasan_unpoison+0x48/0x70
[ 3697.853936] ? __pfx___up_read+0x10/0x10
[ 3697.854221] ksmbd_rpc_ioctl+0x380/0x520
[ 3697.854542] ? __pfx_ksmbd_rpc_ioctl+0x10/0x10
[ 3697.854757] ? kasan_unpoison+0x48/0x70
[ 3697.854962] ? copy_from_kernel_nofault+0x32c/0x4e0
[ 3697.855166] ? kasan_unpoison+0x48/0x70
[ 3697.855416] fsctl_pipe_transceive+0x139/0x7a0
[ 3697.855705] ? __pfx_copy_from_kernel_nofault+0x10/0x10
[ 3697.855937] ? __pfx_fsctl_pipe_transceive+0x10/0x10
[ 3697.856388] ? __sanitizer_cov_trace_switch+0x7b/0x140
[ 3697.856620] smb2_ioctl+0x1141/0x3420
[ 3697.856994] ? __pfx_smb2_ioctl+0x10/0x10
[ 3697.857182] ? get_smb2_cmd_val+0xe3/0x1c0
[ 3697.857655] handle_ksmbd_work+0x9ad/0x15e0
[ 3697.858034] ? __pfx_handle_ksmbd_work+0x10/0x10
[ 3697.858251] ? lock_release+0xf7/0x360
[ 3697.858466] ? process_scheduled_works+0x954/0x1600
[ 3697.858698] ? process_scheduled_works+0x954/0x1600
[ 3697.858905] process_scheduled_works+0xc22/0x1600
[ 3697.859368] ? __pfx_process_scheduled_works+0x10/0x10
[ 3697.859637] ? __pfx_assign_work+0x10/0x10
[ 3697.859896] ? lock_is_held_type+0x7b/0x110
[ 3697.860146] worker_thread+0x975/0xee0
[ 3697.860524] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 3697.860830] ? __kthread_parkme+0x21e/0x260
[ 3697.861105] kthread+0x3a6/0x490
[ 3697.861423] ? __pfx_worker_thread+0x10/0x10
[ 3697.861643] ? __pfx_kthread+0x10/0x10
[ 3697.861878] ret_from_fork+0x55a/0xa20
[ 3697.862194] ? __pfx_ret_from_fork+0x10/0x10
[ 3697.862480] ? __pfx_kthread+0x10/0x10
[ 3697.862714] ret_from_fork_asm+0x1a/0x30
[ 3697.862965] </TASK>
[ 3697.863039]
[ 3697.938882] Allocated by task 20761:
[ 3697.940257] kasan_save_track+0x3e/0x80
[ 3697.941782] __kasan_kmalloc+0x72/0x90
[ 3697.943228] __kvmalloc_node_noprof+0x3e9/0x6a0
[ 3697.944948] handle_generic_event+0x59b/0x750
[ 3697.946592] genl_family_rcv_msg_doit+0x3d6/0x560
[ 3697.946977] genl_rcv_msg+0x67c/0x900
[ 3697.947224] netlink_rcv_skb+0x286/0x580
[ 3697.947488] genl_rcv+0x2d/0x80
[ 3
---truncated---
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-90170 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-90170 的情报信息
请登录查看更多情报信息。
CVE-2026-90170 补丁与修复 (5)
同批安全公告 · Linux · 2026-09-17 · 共 600 条
| CVE-2026-90235 | 9.8 CRITICAL | 内核sunrpc xprtsock并发读取修复 |
| CVE-2026-90104 | 9.8 CRITICAL | NFSv4.1 解码前未清空调用列表 |
| CVE-2026-90173 | 9.8 CRITICAL | SMB SmbDirect 释放完成队列漏洞 |
| CVE-2026-92489 | 9.8 CRITICAL | Linux内核 xfrm 双重释放漏洞 |
| CVE-2026-90151 | 9.8 CRITICAL | NFSv4客户端分配失败回调处理漏洞 |
| CVE-2026-90110 | 9.4 CRITICAL | inetpeer 随机化RB树节点比较 |
| CVE-2026-90230 | 9.1 CRITICAL | Linux内核Nvme-target堆越界读取漏洞 |
| CVE-2026-90414 | 9.1 CRITICAL | IB/isert拒绝声明超出实际接收数据的PDU |
| CVE-2026-90413 | 9.1 CRITICAL | IB/isert 登录PDU数据长度校验漏洞 |
| CVE-2026-90380 | 8.8 HIGH | MT76驱动 mt792x 使用释放后内存漏洞 |
| CVE-2026-93042 | 8.8 HIGH | Linux内核dmaengine模块资源耗尽漏洞 |
| CVE-2026-90425 | 8.8 HIGH | Linux内核 5.x 内核漏洞 |
| CVE-2026-90240 | 8.8 HIGH | Linux内核 IOMMU 别名拆除时刷新缓存错误 |
| CVE-2026-90381 | 8.8 HIGH | Linux内核mt76驱动无线信道切换漏洞 |
| CVE-2026-90329 | 8.8 HIGH | Linux 内核 HID 驱动探测清理同步漏洞 |
| CVE-2026-90357 | 8.8 HIGH | mt76驱动MT7915无线局域网远程拒绝服务漏洞 |
| CVE-2026-90379 | 8.8 HIGH | Linux 内核 mt76 驱动系统崩溃漏洞 |
| CVE-2026-90162 | 8.8 HIGH | Linux ksmbd 锁授予UAF/双重释放竞态漏洞 |
| CVE-2026-93189 | 8.8 HIGH | Linux HID核心使用已释放内存漏洞 |
| CVE-2026-90255 | 8.8 HIGH | Linux内核 Bluetooth 漏洞 |
显示前 20 条，共 600 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-90170
暂无评论