Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99277— ksmbd: hold a connection reference for each session channel

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复： ksmbd：为每个会话通道持有连接引用 ksmbd_session_unregister() 在释放表引用之前，就会将会话从全局表和各连接表中移除。此时，若存在并发的引用持有者，则可能导致该会话及其通道列表在移除后依然保持存活。 由于会话已被从表中移除，连接清理流程无法再找到该未注册的会话以移除其通道。而通道仅存储一个原始连接指针，因此当另一个会话引用持有者仍在访问该连接（例如在执行 SMB3.1.1 绑定或读取 procfs 时）时，该连接可能被提前释放。 修复方案：在

AI Predicted 7.8 Difficulty: Moderate
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99277

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ksmbd: hold a connection reference for each session channel
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d7fd1f98607f2cd358e583f9548bdf0173090a86 ~ 4b333aed69cfc2c8687b86b6a4364a0dffc16dd8 -
Linux Linux 7.3 -

II. Public POCs for CVE-2026-99277

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99277

请登录查看更多情报信息。

Other References for CVE-2026-99277 (2)

Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total

CVE-2026-99282 net/sched: sch_teql: fix use-after-free on lower qdisc drop
CVE-2026-99281 tun: Require CAP_NET_ADMIN to attach to an ownerless device
CVE-2026-99279 ksmbd: reclaim ended sessions on logoff and expiration
CVE-2026-99278 ksmbd: limit sessions on each connection
CVE-2026-99280 ksmbd: drain session procfs readers before dropping table references
CVE-2026-99276 ksmbd: defer connection scavenging while session locks are busy
CVE-2026-99275 smb: client: reject short SESSION_SETUP responses
CVE-2026-99273 ksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99274 smb: client: fix fiemap wild read on empty truncated response
CVE-2026-99271 ALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99272 smb: client: validate the data area in SMB2_read()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux