CVE-2026-90152: smb/server: fix session leak in ksmbd_session_register()

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix session leak in ksmbdsessionregister()

See the procedure below:

smb2sesssetup ksmbdsmb2sessioncreate sessioncreate atomicset(&sess->refcnt, 2) hashadd(sessionstable, &sess->hlist, sess->id) ksmbdsessionregister xastore(&conn->sessions, sess->id, sess) // fail ksmbdusersessionput atomicdec(&sess->refcnt) // refcnt is 1, session is not freed

Remove the session from sessionstable and drop its table reference if xastore() fails.

Affected Software

1 affected component
Linux Kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Implement the described procedure: when xa_store(&conn->sessions, sess->id, sess) fails during ksmbd_smb2_session_create/ksmbd_session_register flow, remove the session from sessions_table and drop its table reference to prevent a session leak.

    Linux kernel (smb/ksmbd) session leak fix in ksmbd_session_register() = Remove the session from sessions_table and drop its table reference if xa_store(&conn->sessions, sess->id, sess) fails

Event History

Sep 17, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
Description

Frequently Asked Questions

1

What condition triggers the leaked session?

The leak occurs when ksmbd_session_register() calls xa_store() for a newly created SMB2 session and xa_store() fails. The session has already been added to sessions_table, and the failure path drops only one reference, leaving the table reference and the session allocated.

2

Which component is affected?

The affected component is the Linux kernel SMB server, ksmbd. The issue is in the SMB2 session-setup path.

3

What does the fix change?

The fix removes the session from sessions_table and drops its table reference when xa_store() fails, allowing the session to be freed.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203