CVE-2026-99277
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.
View original CVE JSON
{
"id": "CVE-2026-99277",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-11-07T14:17:03.080",
"lastModified": "2026-11-07T14:17:03.080",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: hold a connection reference for each session channel\n\nksmbd_session_unregister() removes a session from the global and per-\nconnection tables before dropping the table reference. A concurrent\nreference holder can keep the session and its channel list alive after\nthose removals.\n\nConnection cleanup can no longer find the unpublished session to remove its\nchannels. Since a channel only stores a raw conn pointer, the connection\ncan be freed while another session reference holder is still accessing it,\nfor example during SMB3.1.1 binding or a procfs read.\n\nTake a connection reference when registering a channel and release it on\ninsertion failure, channel removal, or final session destruction. Keep the\nchannels and signing keys until the session is destroyed so a response can\nstill be signed after the session has been unregistered."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
"lessThan": "4b333aed69cfc2c8687b86b6a4364a0dffc16dd8",
"versionType": "git",
"status": "affected"
},
{
"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
"lessThan": "add8d7fb04efe564193df73581889c62fc0016f1",
"versionType": "git",
"status": "affected"
},
{
"version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf",
"versionType": "git",
"status": "affected"
},
{
"version": "7.2.8",
"lessThan": "7.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "7.3",
"status": "affected"
},
{
"version": "0",
"lessThan": "7.3",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3.2",
"lessThanOrEqual": "7.3.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.4-rc1",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b333aed69cfc2c8687b86b6a4364a0dffc16dd8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/add8d7fb04efe564193df73581889c62fc0016f1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}