CVE-2026-99279— ksmbd: reclaim ended sessions on logoff and expiration
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： ksmbd：在注销和过期时回收已结束的会话 LOGOFF 操作以及旧会话的替换会导致会话状态变为“已过期”，且其凭证过期时间被设置为零。如果所属连接上不再有新的建立请求到达，这些已结束的会话可能会继续占用内存和连接槽位。 修复措施包括： 在注销会话时，若请求引用仍保持其响应签名和加密密钥有效，则先将其从会话表中移除（unpublish）。 在释放会话表引用之前，先删除其 procfs 条目，以防止读取者在最后一次引用释放时误删自身条目。 删除 procfs 条目后，将
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99279
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ksmbd: reclaim ended sessions on logoff and expiration
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reclaim ended sessions on logoff and expiration
LOGOFF and previous-session replacement leave sessions Expired with a
zero credential expiry. Ended sessions can retain their memory and
connection slots when no further setup arrives on the owning connection.
Unpublish a logged-off session while the request reference keeps its
response signing and encryption keys alive. Remove its procfs entry
before dropping the table reference so a reader cannot remove its own
entry on the last put. Clear proc_entry after removal to avoid removing
it twice.
Reclaim ended sessions from the global table in the existing expiration
worker before it acquires conn_list_lock. Only select Expired sessions
with zero credential expiry and no references beyond the table
reference. Keep sessions whose Kerberos credentials expired available
for reauthentication.
Unlink the session from its setup connection and all channel
connections, so SMB2 sessions and sessions with only secondary SMB3
channels are covered. The session already holds connection references,
and sessions_table_lock prevents concurrent channel removal. Queue
sessions on a separate disposal list, leaving their hash nodes unhashed,
and remove procfs entries and drop table references outside the locks.
Keep the pending setup check before allocating a new session so
abandoned InProgress sessions can release their slots even at the
connection limit. Retain the timeout and reference checks and dispose of
those sessions outside the locks. Leave ended Expired sessions to the
expiration worker.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99279
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99279
请登录查看更多情报信息。
Other References for CVE-2026-99279 (2)
Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total
| CVE-2026-99282 | net/sched: sch_teql: fix use-after-free on lower qdisc drop | |
| CVE-2026-99281 | tun: Require CAP_NET_ADMIN to attach to an ownerless device | |
| CVE-2026-99277 | ksmbd: hold a connection reference for each session channel | |
| CVE-2026-99278 | ksmbd: limit sessions on each connection | |
| CVE-2026-99280 | ksmbd: drain session procfs readers before dropping table references | |
| CVE-2026-99276 | ksmbd: defer connection scavenging while session locks are busy | |
| CVE-2026-99275 | smb: client: reject short SESSION_SETUP responses | |
| CVE-2026-99273 | ksmbd: reserve space for the UTF-16 terminator in stream info | |
| CVE-2026-99274 | smb: client: fix fiemap wild read on empty truncated response | |
| CVE-2026-99271 | ALSA: line6: Clear prev_fbuf on capture buffer release | |
| CVE-2026-99272 | smb: client: validate the data area in SMB2_read() |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop -
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99278
ksmbd: limit sessions on each connection -
CVE-2026-99280
ksmbd: drain session procfs readers before dropping table re
Same vendor: Linux
-
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop -
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99278
ksmbd: limit sessions on each connection -
CVE-2026-99280
ksmbd: drain session procfs readers before dropping table re