# ksmbd: validate ipc response length before dereferencing its fields CVE record · `CVE-2026-90170` - **Identifiers:** `CVE-2026-90170` - **State:** Confirmed - **Severity:** No CVSS score - **Critical:** No - **CNA:** Linux - **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md) - **Published:** 17 Sept 2026 - **Updated:** 30 Oct 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: Linux) at 17 Sept 2026, 16:06 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: Linux. Product: Linux. - affected: `bf396208418371174869baba9434535cd3288e80 to before 17b7d1a2b4d5473df5dca8c9a07d65021806c23a` (git) - affected: `7dd0c858e1909769a4c91842724315ee74f1a5f1 to before 398cba4b646a6c08ff3d79e6b1e70e5ddae8a065` (git) - affected: `299db777ea0cfa5c407e41b045c24a14c034c27b to before 0aa8f94bfd4d818284c8a7ce0040d40ca1ec3595` (git) - affected: `d6a6aa81eac2c9bff66dc6e191179cb69a14426b to before c494fcf8e89e3c970e13d78ebe62bf5d8f2b1c52` (git) - affected: `d6a6aa81eac2c9bff66dc6e191179cb69a14426b to before e9b33376bd07bca4175f7bcc2d6034ef250f8181` (git) - affected: `52518503a1a00bc33e9522c4eb05df023e3ae978` (git) - affected: `99c631d0366c1eab8fb188fe66425f4581ebdde4` (git) - affected: `6.6.141 to before 6.6.157` (semver) - affected: `6.12.84 to before 6.12.110` (semver) - affected: `6.18.25 to before 6.18.52` (semver) - affected: `6.1.191 to before 6.2` (semver) - affected: `7.0.2 to before 7.1` (semver) - Other versions: unaffected - Vendor: Linux. Product: Linux. - affected: `7.1` - unaffected: `before 7.1` (semver) - unaffected: `6.6.157 to 6.6.*, inclusive` (semver) - unaffected: `6.12.110 to 6.12.*, inclusive` (semver) - unaffected: `6.18.52 to 6.18.*, inclusive` (semver) - unaffected: `7.2.6 to 7.2.*, inclusive` (semver) - unaffected: `7.3 to *, inclusive` (original_commit_for_fix) - Other versions: affected ## Machine-written summary Summary written by Claude Haiku from the source advisory. Not reviewed by a person. > The ksmbd server in the Linux kernel reads length fields from a response supplied by the userspace ksmbd daemon before checking that the buffer is large enough, so a short response causes an out-of-bounds read. The source gives few details on what an attacker would need beyond control of that daemon response. Upgrade to a fixed kernel: 6.6.157, 6.12.110, 6.18.52 or 7.2.6 in their respective branches, or a later release. Written 12 Nov 2026. ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation No source has published a CVSS score for this record yet. - **CISA KEV:** Not listed. - **EPSS:** 0.0020, the 9th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 17 Sept 2026. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2026-90170](https://www.cve.org/CVERecord?id=CVE-2026-90170) - [NVD: CVE-2026-90170](https://nvd.nist.gov/vuln/detail/CVE-2026-90170) ### References from the CNA - - - - - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .