CVE-2026-90125: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-2f7p-h662-999p
Share
Published
Advisory Summary

CVE-2026-90125 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90125 at a Glance

CVE Identifier CVE-2026-90125
GHSA Identifier GHSA-2f7p-h662-999p
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90125

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90125, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2_new_read_req() smb2_new_read_req() allocates the request buffer with smb2_plain_req_init() but only publishes it to the caller with *buf = req at the very end of the function. Two error returns sit in between: rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server, (void **) &req, total_len); if (rc) return rc; if (server == NULL) return -ECONNABORTED; [...] rdata->mr = smbd_register_mr(server->smbd_conn, &rdata->subreq.io_iter, true, need_invalidate); if (!rdata->mr) return -EAGAIN; On either of them the buffer is neither released nor handed back, so it is leaked. The caller cannot clean up after it: smb2_async_readv() does 'goto out' on a non-zero return, which skips the cifs_small_buf_release(buf) at async_readv_out, and buf has not been assigned at that point in any case. The write path has never had this problem. smb2_async_writev() registers the memory region inline and jumps to its release label instead of returning: wdata->mr = smbd_register_mr(...); if (!wdata->mr) { rc = -EAGAIN; goto async_writev_out; } Commit b7972092199f ("cifs: smbd: Retry on memory registration failure") changed both sides from -ENOBUFS to -EAGAIN in a single patch, which puts the two shapes next to each other. Only the -EAGAIN return is reachable in practice, because smb2_plain_req_init() calls smb2_reconnect() first and that already fails with -EIO when server is NULL, before anything is allocated. Both returns are given the same treatment here rather than leaving one of them correct only by accident. Because -EAGAIN is a replayable error, the failure also reaches the retry block at the end of smb2_async_readv(), which marks the subrequest NETFS_SREQ_NEED_RETRY, so a failing registration can be retried rather than ending the I/O, and every attempt that reaches it leaks another buffer. smb2_should_replay() short-circuits on tcon->retry, so on a hard mount the attempt count is not bounded by the retrans setting. Only the asynchronous read path is affected. The synchronous SMB2_read() caller passes rdata == NULL and the memory registration block is guarded on rdata. The memory registration failure path was pointed out by the Sashiko AI reviewer while it was reviewing an unrelated patch to smb2_async_readv().

References

NVD — CVE-2026-90125 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90125
git.kernel.org/stable/c/12092ed284... WEB
https://git.kernel.org/stable/c/12092ed28434bf41e08d41e3c5269eb6b337fc02
git.kernel.org/stable/c/442c5f1358... WEB
https://git.kernel.org/stable/c/442c5f1358ced0d4e716778ac06f1e323a7e4f21
git.kernel.org/stable/c/5806694007... WEB
https://git.kernel.org/stable/c/58066940076b90c16e821fd6f9767cd979cbdb5e
git.kernel.org/stable/c/73f6bdb038... WEB
https://git.kernel.org/stable/c/73f6bdb0380486ab37fe12cd74de20abfaf5d3ae
git.kernel.org/stable/c/deb6468f41... WEB
https://git.kernel.org/stable/c/deb6468f4164640e4dc875f008aa449cf55987a5

Frequently Asked Questions

What is CVE-2026-90125?
CVE-2026-90125 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90125?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90125?
CVE-2026-90125 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90125?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2f7p-h662-999p",
  "modified" : "2026-09-17T18:31:52Z",
  "published" : "2026-09-17T18:31:51Z",
  "aliases" : [ "CVE-2026-90125" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix request buffer leak in smb2_new_read_req()\n\nsmb2_new_read_req() allocates the request buffer with\nsmb2_plain_req_init() but only publishes it to the caller with\n*buf = req at the very end of the function. Two error returns sit in\nbetween:\n\n\trc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server,\n\t\t\t\t (void **) &req, total_len);\n\tif (rc)\n\t\treturn rc;\n\n\tif (server == NULL)\n\t\treturn -ECONNABORTED;\n\t[...]\n\t\trdata->mr = smbd_register_mr(server->smbd_conn,\n\t\t\t\t\t     &rdata->subreq.io_iter,\n\t\t\t\t\t     true, need_invalidate);\n\t\tif (!rdata->mr)\n\t\t\treturn -EAGAIN;\n\nOn either of them the buffer is neither released nor handed back, so\nit is leaked. The caller cannot clean up after it: smb2_async_readv()\ndoes 'goto out' on a non-zero return, which skips the\ncifs_small_buf_release(buf) at async_readv_out, and buf has not been\nassigned at that point in any case.\n\nThe write path has never had this problem. smb2_async_writev()\nregisters the memory region inline and jumps to its release label\ninstead of returning:\n\n\twdata->mr = smbd_register_mr(...);\n\tif (!wdata->mr) {\n\t\trc = -EAGAIN;\n\t\tgoto async_writev_out;\n\t}\n\nCommit b7972092199f (\"cifs: smbd: Retry on memory registration\nfailure\") changed both sides from -ENOBUFS to -EAGAIN in a single\npatch, which puts the two shapes next to each other.\n\nOnly the -EAGAIN return is reachable in practice, because\nsmb2_plain_req_init() calls smb2_reconnect() first and that already\nfails with -EIO when server is NULL, before anything is allocated.\nBoth returns are given the same treatment here rather than leaving\none of them correct only by accident.\n\nBecause -EAGAIN is a replayable error, the failure also reaches the\nretry block at the end of smb2_async_readv(), which marks the\nsubrequest NETFS_SREQ_NEED_RETRY, so a failing registration can be\nretried rather than ending the I/O, and every attempt that reaches it\nleaks another buffer. smb2_should_replay() short-circuits on\ntcon->retry, so on a hard mount the attempt count is not bounded by\nthe retrans setting.\n\nOnly the asynchronous read path is affected. The synchronous\nSMB2_read() caller passes rdata == NULL and the memory registration\nblock is guarded on rdata.\n\nThe memory registration failure path was pointed out by the Sashiko\nAI reviewer while it was reviewing an unrelated patch to\nsmb2_async_readv().",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90125"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/12092ed28434bf41e08d41e3c5269eb6b337fc02"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/442c5f1358ced0d4e716778ac06f1e323a7e4f21"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/58066940076b90c16e821fd6f9767cd979cbdb5e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/73f6bdb0380486ab37fe12cd74de20abfaf5d3ae"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/deb6468f4164640e4dc875f008aa449cf55987a5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:04Z"
  }
}