CVE-2026-99276 · Runtime
NO FIX YET
A lock-ordering problem in the Linux kernel's ksmbd SMB server can cause the connection expiration worker to deadlock against session teardown. The sources do not state what an attacker gains beyond disrupting the SMB server.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems running the Linux kernel's ksmbd in-kernel SMB file server are the ones to look at, since the flaw sits in its connection scavenging path. Machines that do not run ksmbd are not affected. The sources do not say which kernel versions are affected.
Not affected if ksmbd-not-loaded
Who cares file-server, kernel, ksmbd, linux, smb
uname -r and whether the ksmbd module is loaded with lsmod | grep ksmbdUnknown from the sources.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: defer connection scavenging while session locks are busy
The expiration worker holds conn_list_lock for reading while checking for authenticated sessions. Without this change, the check can wait for conn->session_lock or sessions_table_lock.
In destroy_previous_session(), the status updates after ksmbd_conn_wait_idle_sess() run with both session locks held for writing. Both the KSMBD_SESS_GOOD error path and the KSMBD_SESS_NEED_SETUP success path call ksmbd_all_conn_set_status(), which takes conn_list_lock for reading.
A writer queued on conn_list_lock can block these new read acquisitions. The worker then waits for a session lock held by destroy_previous_session(), which waits behind the writer. The writer cannot proceed until the worker releases conn_list_lock.
Try both session locks instead of waiting in the scavenging check. Keep the connection when either lock is busy and let the periodic worker retry later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.