CVE-2026-90154: ksmbd: scope session state changes to bound connections
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: scope session state changes to bound connections
ksmbdallconnsetstatus() treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move an unrelated connection to NEEDRECONNECT or NEEDSETUP.
Pass the target session itself and select connections using either the connection-local session xarray or the session's permanent channel list. Use the same association test while waiting for requests to drain.
Serialize session-wide status changes under requestlock and do not overwrite EXITING or RELEASING. Protect the shutdown transition with the same lock so a concurrent session update cannot revive a closing connection.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed for this issue to occur?
The issue involves ksmbd connections with a transient binding flag set during a logoff or session replacement. Under those conditions, an unrelated connection can be incorrectly treated as belonging to the target SessionId and moved to NEED_RECONNECT or NEED_SETUP.
What is the operational impact of a successful trigger?
An unrelated connection may have its session state changed and be forced to reconnect or repeat setup. Concurrent session updates during shutdown could also revive a connection that is closing unless status changes are properly serialized.
What should be done if an update cannot be applied immediately?
The provided information does not identify a configuration workaround. Reduce exposure to the affected ksmbd session-management paths where possible, particularly logoff and session replacement activity involving bound connections.