CVE-2026-90154: ksmbd: scope session state changes to bound connections

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: scope session state changes to bound connections

ksmbdallconnsetstatus() treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move an unrelated connection to NEEDRECONNECT or NEEDSETUP.

Pass the target session itself and select connections using either the connection-local session xarray or the session's permanent channel list. Use the same association test while waiting for requests to drain.

Serialize session-wide status changes under requestlock and do not overwrite EXITING or RELEASING. Protect the shutdown transition with the same lock so a concurrent session update cannot revive a closing connection.

Affected Software

1 affected component
Linux Kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
Description

Frequently Asked Questions

1

What conditions are needed for this issue to occur?

The issue involves ksmbd connections with a transient binding flag set during a logoff or session replacement. Under those conditions, an unrelated connection can be incorrectly treated as belonging to the target SessionId and moved to NEED_RECONNECT or NEED_SETUP.

2

What is the operational impact of a successful trigger?

An unrelated connection may have its session state changed and be forced to reconnect or repeat setup. Concurrent session updates during shutdown could also revive a connection that is closing unless status changes are properly serialized.

3

What should be done if an update cannot be applied immediately?

The provided information does not identify a configuration workaround. Reduce exposure to the affected ksmbd session-management paths where possible, particularly logoff and session replacement activity involving bound connections.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203