CVE-2026-99277
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() remo…
Impact
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.
An attacker can exploit this over the network, with a regular user account, without any action by a user. Specific conditions have to be met, which makes an attack harder. If it succeeds: high risk of data being read, high risk of data or systems being changed, high risk of outages.
Affected products · Linux
| Product | Affected versions |
|---|---|
| Linux | from 7.2.8 before 7.3 from d7fd1f98607f2cd358e583f9548bdf0173090a86 before 4b333aed69cfc2c8687b86b6a4364a0dffc16dd8 from d7fd1f98607f2cd358e583f9548bdf0173090a86 before add8d7fb04efe564193df73581889c62fc0016f1 Versions c99ea7855124ca1428a1e59c2b4590aaef34eacf, patch: 7.4-rc1, patch: 7.3.2 |