CVE-2026-99276 is a vulnerability in Linux Kernel
Published on November 7, 2026
ksmbd: defer connection scavenging while session locks are busy
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: defer connection scavenging while session locks are busy
The expiration worker holds conn_list_lock for reading while checking
for authenticated sessions. Without this change, the check can wait for
conn->session_lock or sessions_table_lock.
In destroy_previous_session(), the status updates after
ksmbd_conn_wait_idle_sess() run with both session locks held for
writing. Both the KSMBD_SESS_GOOD error path and the
KSMBD_SESS_NEED_SETUP success path call ksmbd_all_conn_set_status(),
which takes conn_list_lock for reading.
A writer queued on conn_list_lock can block these new read acquisitions.
The worker then waits for a session lock held by
destroy_previous_session(), which waits behind the writer. The writer
cannot proceed until the worker releases conn_list_lock.
Try both session locks instead of waiting in the scavenging check. Keep
the connection when either lock is busy and let the periodic worker
retry later.
Products Associated with CVE-2026-99276
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version d7fd1f98607f2cd358e583f9548bdf0173090a86 and below 4e4e8b38994a0b0fc23f00ca6698b469a41abe70 is affected.
- Version d7fd1f98607f2cd358e583f9548bdf0173090a86 and below b4bae7af1154089be87c7475218264fcbfd16d10 is affected.
- Version c99ea7855124ca1428a1e59c2b4590aaef34eacf is affected.
- Version 7.2.8 and below 7.3 is affected.
- Version 7.3 is affected.
- Before 7.3 is unaffected.
- Version 7.3.2, <= 7.3.* is unaffected.
- Version 7.4-rc1, <= * is unaffected.