CVE-2026-90152: smb/server: fix session leak in ksmbd_session_register()
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix session leak in ksmbdsessionregister()
See the procedure below:
smb2sesssetup ksmbdsmb2sessioncreate sessioncreate atomicset(&sess->refcnt, 2) hashadd(sessionstable, &sess->hlist, sess->id) ksmbdsessionregister xastore(&conn->sessions, sess->id, sess) // fail ksmbdusersessionput atomicdec(&sess->refcnt) // refcnt is 1, session is not freed
Remove the session from sessionstable and drop its table reference if xastore() fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement the described procedure: when xa_store(&conn->sessions, sess->id, sess) fails during ksmbd_smb2_session_create/ksmbd_session_register flow, remove the session from sessions_table and drop its table reference to prevent a session leak.
Linux kernel (smb/ksmbd) session leak fix in ksmbd_session_register() = Remove the session from sessions_table and drop its table reference if xa_store(&conn->sessions, sess->id, sess) fails
Event History
Frequently Asked Questions
What condition triggers the leaked session?
The leak occurs when ksmbd_session_register() calls xa_store() for a newly created SMB2 session and xa_store() fails. The session has already been added to sessions_table, and the failure path drops only one reference, leaving the table reference and the session allocated.
Which component is affected?
The affected component is the Linux kernel SMB server, ksmbd. The issue is in the SMB2 session-setup path.
What does the fix change?
The fix removes the session from sessions_table and drops its table reference when xa_store() fails, allowing the session to be freed.