CVE-2026-99276: ksmbd: defer connection scavenging while session locks are busy
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: defer connection scavenging while session locks are busy
The expiration worker holds connlistlock for reading while checking for authenticated sessions. Without this change, the check can wait for conn->sessionlock or sessionstablelock.
In destroyprevioussession(), the status updates after ksmbdconnwaitidlesess() run with both session locks held for writing. Both the KSMBDSESSGOOD error path and the KSMBDSESSNEEDSETUP success path call ksmbdallconnsetstatus(), which takes connlistlock for reading.
A writer queued on connlistlock can block these new read acquisitions. The worker then waits for a session lock held by destroyprevioussession(), which waits behind the writer. The writer cannot proceed until the worker releases connlistlock.
Try both session locks instead of waiting in the scavenging check. Keep the connection when either lock is busy and let the periodic worker retry later.