Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99278— ksmbd: limit sessions on each connection

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： ksmbd：限制每个连接上的会话数量 原有的待处理设置（pending setup）限制仅统计“进行中”（InProgress）的会话。客户端可以重复完成身份验证，从而在单个连接上保留无限制的“有效”（Valid）会话。 修复方案如下：在分配会话之前预先预留一个连接槽位，并在身份验证进行期间保持对该连接的引用。第一个 SMB3 通道将接管该预留槽位；若绑定到另一个连接，则在该连接上预留一个槽位。重新认证和认证续期将复用现有的预留槽位。在分配失败、插入失败、通道移除或会话

AI Predicted 7.5 Difficulty: Moderate
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99278

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ksmbd: limit sessions on each connection
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a connection slot before allocating a session and retain a connection reference while authentication is in progress. The first SMB3 channel takes over that reservation; binding to another connection reserves one slot there. Reauthentication and authentication continuation reuse the existing reservation. Return slots on allocation or insertion failure, channel removal, and final session destruction. Accept max_sessions_per_connection in reserved startup-request space and default to 64 when older tools leave it zero. Keep the request size and existing field offsets unchanged. Expose the configured limit in procfs. The existing connection limits bound the aggregate number of sessions without a separate global session allocation limit.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d7fd1f98607f2cd358e583f9548bdf0173090a86 ~ 94f8462fc9d5332bc54e91605003c17381e9171a -
Linux Linux 7.3 -

II. Public POCs for CVE-2026-99278

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99278

请登录查看更多情报信息。

Other References for CVE-2026-99278 (2)

Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total

CVE-2026-99282 net/sched: sch_teql: fix use-after-free on lower qdisc drop
CVE-2026-99281 tun: Require CAP_NET_ADMIN to attach to an ownerless device
CVE-2026-99277 ksmbd: hold a connection reference for each session channel
CVE-2026-99279 ksmbd: reclaim ended sessions on logoff and expiration
CVE-2026-99280 ksmbd: drain session procfs readers before dropping table references
CVE-2026-99276 ksmbd: defer connection scavenging while session locks are busy
CVE-2026-99275 smb: client: reject short SESSION_SETUP responses
CVE-2026-99273 ksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99274 smb: client: fix fiemap wild read on empty truncated response
CVE-2026-99271 ALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99272 smb: client: validate the data area in SMB2_read()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux