CVE-2026-99277: ksmbd: hold a connection reference for each session channel

Published Nov 7, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: hold a connection reference for each session channel

ksmbdsessionunregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals.

Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read.

Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:08 PM

Data Sourced

via MITRE·02:08 PM

Description

Data Sourced

via NVD·02:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the Linux kernel's ksmbd SMB server component are exposed when sessions and their channels can be accessed concurrently with connection cleanup. The described paths include SMB3.1.1 session binding and procfs reads.

What conditions are required to trigger the vulnerability?

A session must be removed from the global and per-connection tables while another holder still retains a reference to that session and accesses its channel list. Connection cleanup must then occur while a channel retains only a raw pointer to the connection.

What is the likely impact of successful triggering?

The connection can be freed while a remaining session reference holder accesses it through a channel, creating a use-after-free condition. The description also notes that signing keys and channels may still be needed to sign a response after session unregistration.

How can I determine whether my kernel contains the fix?

Check whether the kernel includes either referenced stable commit: 4b333aed69cfc2c8687b86b6a4364a0dffc16dd8 or add8d7fb04efe564193df73581889c62fc0016f1. The fix takes a connection reference for every registered session channel and releases it when insertion fails, when the channel is removed, or when the session is finally destroyed.

CVE-2026-99277: ksmbd: hold a connection reference for each session channel

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions are required to trigger the vulnerability?

What is the likely impact of successful triggering?

How can I determine whether my kernel contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions are required to trigger the vulnerability?

What is the likely impact of successful triggering?

How can I determine whether my kernel contains the fix?