CVE-2026-99280— ksmbd: drain session procfs readers before dropping table references

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： ksmbd：在释放表引用之前，先清空会话的 procfs 读取者。会话注册失败和连接清理过程可能会在每会话的 procfs 条目仍然可访问时，就提前释放了表的引用。如果某个读取者持有最后一个剩余引用，其最终的操作会从自身的回调函数中调用，并等待该回调执行完成。修复方案如下：在注册失败路径中，先移除 procfs 条目，再释放表的引用。在连接清理过程中，将已移除的会话加入队列，并在释放两个会话锁之后，清空这些会话对应的 procfs 读取者，随后再返回其表引用

AI Predicted 7.8 Difficulty: Moderate Updated Nov 07, 2026

Possible ATT&CK Techniques 3 AI

T1069 · Permission Groups Discovery T1083 · File and Directory Discovery T1012 · Query Registry

Updated Nov 07, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ksmbd: drain session procfs readers before dropping table references

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the last remaining reference, its final put calls proc_remove() from its own callback and waits for that callback to finish. Remove the procfs entry before dropping the table reference in the registration failure path. Queue sessions removed during connection cleanup and drain their procfs readers after releasing both session locks, then return their table references. Keep the global hash node unhashed while a session is queued so a concurrent unregister cannot drop the reference again. Previous-session replacement also destroys the file table before the session is finally freed. Detach the idr under the lock used by procfs file counters, and report zero files after it has been detached. This prevents a reader from accessing the idr during or after its destruction.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	d7fd1f98607f2cd358e583f9548bdf0173090a86 ~ 6789f0983f8e85ce3a5ed8c50fc05d613ead9c2c	-
Linux	Linux	7.3	-

II. Public POCs for CVE-2026-99280

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99280

请登录查看更多情报信息。

Other References for CVE-2026-99280 (2)

https://www.cve.org/CVERecord?id=CVE-2026-99280

Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total

CVE-2026-99282		net/sched: sch_teql: fix use-after-free on lower qdisc drop
CVE-2026-99281		tun: Require CAP_NET_ADMIN to attach to an ownerless device
CVE-2026-99277		ksmbd: hold a connection reference for each session channel
CVE-2026-99279		ksmbd: reclaim ended sessions on logoff and expiration
CVE-2026-99278		ksmbd: limit sessions on each connection
CVE-2026-99276		ksmbd: defer connection scavenging while session locks are busy
CVE-2026-99275		smb: client: reject short SESSION_SETUP responses
CVE-2026-99273		ksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99274		smb: client: fix fiemap wild read on empty truncated response
CVE-2026-99271		ALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99272		smb: client: validate the data area in SMB2_read()

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux