CVE-2026-99277 is a vulnerability in Linux Kernel
Published on November 7, 2026
ksmbd: hold a connection reference for each session channel
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: hold a connection reference for each session channel
ksmbd_session_unregister() removes a session from the global and per-
connection tables before dropping the table reference. A concurrent
reference holder can keep the session and its channel list alive after
those removals.
Connection cleanup can no longer find the unpublished session to remove its
channels. Since a channel only stores a raw conn pointer, the connection
can be freed while another session reference holder is still accessing it,
for example during SMB3.1.1 binding or a procfs read.
Take a connection reference when registering a channel and release it on
insertion failure, channel removal, or final session destruction. Keep the
channels and signing keys until the session is destroyed so a response can
still be signed after the session has been unregistered.
Products Associated with CVE-2026-99277
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version d7fd1f98607f2cd358e583f9548bdf0173090a86 and below 4b333aed69cfc2c8687b86b6a4364a0dffc16dd8 is affected.
- Version d7fd1f98607f2cd358e583f9548bdf0173090a86 and below add8d7fb04efe564193df73581889c62fc0016f1 is affected.
- Version c99ea7855124ca1428a1e59c2b4590aaef34eacf is affected.
- Version 7.2.8 and below 7.3 is affected.
- Version 7.3 is affected.
- Before 7.3 is unaffected.
- Version 7.3.2, <= 7.3.* is unaffected.
- Version 7.4-rc1, <= * is unaffected.