Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99276— ksmbd: defer connection scavenging while session locks are busy

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： ksmbd：在会话锁被占用时延迟执行连接清理 过期检查工作线程在检查已认证的会话期间会持有 conn_list_lock 的读锁。若不进行此项修改，该检查可能会阻塞等待 conn->session_lock 或 sessions_table_lock。 在 destroy_previous_session() 函数中，状态更新是在 ksmbd_conn_wait_idle_sess() 执行之后进行的，此时两个会话锁均以写模式被持有。无论是 KSMBD_SESS_GOO

AI Predicted 5.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1068.001
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99276

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ksmbd: defer connection scavenging while session locks are busy
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session locks are busy The expiration worker holds conn_list_lock for reading while checking for authenticated sessions. Without this change, the check can wait for conn->session_lock or sessions_table_lock. In destroy_previous_session(), the status updates after ksmbd_conn_wait_idle_sess() run with both session locks held for writing. Both the KSMBD_SESS_GOOD error path and the KSMBD_SESS_NEED_SETUP success path call ksmbd_all_conn_set_status(), which takes conn_list_lock for reading. A writer queued on conn_list_lock can block these new read acquisitions. The worker then waits for a session lock held by destroy_previous_session(), which waits behind the writer. The writer cannot proceed until the worker releases conn_list_lock. Try both session locks instead of waiting in the scavenging check. Keep the connection when either lock is busy and let the periodic worker retry later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d7fd1f98607f2cd358e583f9548bdf0173090a86 ~ 4e4e8b38994a0b0fc23f00ca6698b469a41abe70 -
Linux Linux 7.3 -

II. Public POCs for CVE-2026-99276

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99276

请登录查看更多情报信息。

Other References for CVE-2026-99276 (2)

Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total

CVE-2026-99282 net/sched: sch_teql: fix use-after-free on lower qdisc drop
CVE-2026-99281 tun: Require CAP_NET_ADMIN to attach to an ownerless device
CVE-2026-99277 ksmbd: hold a connection reference for each session channel
CVE-2026-99279 ksmbd: reclaim ended sessions on logoff and expiration
CVE-2026-99278 ksmbd: limit sessions on each connection
CVE-2026-99280 ksmbd: drain session procfs readers before dropping table references
CVE-2026-99275 smb: client: reject short SESSION_SETUP responses
CVE-2026-99273 ksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99274 smb: client: fix fiemap wild read on empty truncated response
CVE-2026-99271 ALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99272 smb: client: validate the data area in SMB2_read()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux