{"id":"CVE-2026-99276","kind":"vulnerability","aliases":["CVE-2026-99276"],"related":[],"title":"Linux kernel ksmbd: lock ordering flaw can stall SMB connection scavenging","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: defer connection scavenging while session locks are busy\n\nThe expiration worker holds conn_list_lock for reading while checking\nfor authenticated sessions. Without this change, the check can wait for\nconn->session_lock or sessions_table_lock.\n\nIn destroy_previous_session(), the status updates after\nksmbd_conn_wait_idle_sess() run with both session locks held for\nwriting. Both the KSMBD_SESS_GOOD error path and the\nKSMBD_SESS_NEED_SETUP success path call ksmbd_all_conn_set_status(),\nwhich takes conn_list_lock for reading.\n\nA writer queued on conn_list_lock can block these new read acquisitions.\nThe worker then waits for a session lock held by\ndestroy_previous_session(), which waits behind the writer. The writer\ncannot proceed until the worker releases conn_list_lock.\n\nTry both session locks instead of waiting in the scavenging check. Keep\nthe connection when either lock is busy and let the periodic worker\nretry later.","summary":"A lock-ordering problem in the Linux kernel's ksmbd SMB server can cause the connection expiration worker to deadlock against session teardown. The sources do not state what an attacker gains beyond disrupting the SMB server.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-server","kernel","ksmbd","linux","runtime","smb"],"not_affected_if":["ksmbd-not-loaded"],"how_to_check":"- Check the kernel version with `uname -r` and whether the ksmbd module is loaded with `lsmod | grep ksmbd`","fix":null,"status":"open","published_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","triaged_at":"2026-11-07T14:49:53+00:00","updated_at":"2026-11-07T14:49:53+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-07T14:49:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel ksmbd: lock ordering flaw can stall SMB connection scavenging","impact":"low","summary":"A lock-ordering problem in the Linux kernel's ksmbd SMB server can cause the connection expiration worker to deadlock against session teardown. The sources do not state what an attacker gains beyond disrupting the SMB server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","kernel","ksmbd","smb","file-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"SMB server connection handling stalls or deadlocks until restart","analyst_note":"Check the kernel.org stable commit and NVD ranges for affected and fixed kernel versions and the severity score.","how_to_check":"- Check the kernel version with `uname -r` and whether the ksmbd module is loaded with `lsmod | grep ksmbd`\n- unknown: the sources do not list affected kernel version ranges","plain_action":"","needs_analyst":true,"not_affected_if":["ksmbd-not-loaded"],"who_is_affected":"Systems running the Linux kernel's ksmbd in-kernel SMB file server are the ones to look at, since the flaw sits in its connection scavenging path. Machines that do not run ksmbd are not affected. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4477,"output_tokens":535,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99276':14A,17A 'acquisit':173C 'attack':57B 'authent':95C 'behind':189C 'beyond':59B 'block':169C 'busi':82C,221C 'call':148C 'cannot':194C 'caus':40B 'chang':99C 'check':93C,101C,213C 'conn':87C,105C,121C,151C,156C,165C,200C 'connect':10A,42B,76C,216C 'cve':12A,15A 'deadlock':46B 'defer':75C 'destroy':113C,184C 'disrupt':60B 'either':218C 'error':138C 'expir':43B,84C 'file':19B 'file-serv':18B 'flaw':6A 'follow':69C 'gain':58B 'good':137C 'held':130C,182C 'hold':86C 'idl':123C 'instead':207C 'keep':214C 'kernel':2A,21B,34B,67C 'ksmbd':3A,22B,36B,74C,120C,135C,142C,149C 'later':228C 'let':223C 'linux':1A,23B,33B,66C 'list':88C,157C,166C,201C 'lock':4A,28B,80C,89C,107C,111C,129C,158C,167C,181C,202C,206C,219C 'lock-ord':27B 'need':144C 'new':171C 'order':5A,29B 'path':139C,147C 'period':225C 'previous':114C,185C 'problem':30B 'proceed':195C 'queu':163C 'read':91C,160C,172C 'releas':199C 'resolv':73C 'retri':227C 'run':125C 'runtim':24B 'scaveng':11A,77C,212C 'server':20B,38B,63B 'sess':124C,136C,143C 'session':48B,79C,96C,106C,109C,115C,128C,180C,186C,205C 'set':152C 'setup':145C 'smb':9A,25B,37B,62B 'sourc':51B 'stall':8A 'state':54B 'status':117C,153C 'success':146C 'tabl':110C 'take':155C 'teardown':49B 'tri':203C 'updat':118C 'vulner':70C 'wait':103C,122C,177C,188C,209C 'without':97C 'worker':44B,85C,175C,198C,226C 'write':132C 'writer':162C,191C,193C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel's ksmbd in-kernel SMB file server are the ones to look at, since the flaw sits in its connection scavenging path. Machines that do not run ksmbd are not affected. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fileserver","kernel","ksmbd","linux","runtime","smb","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-99276':14A,17A 'connect':10A 'cve':12A,15A 'flaw':6A 'kernel':2A 'ksmbd':3A 'linux':1A 'lock':4A 'order':5A 'scaveng':11A 'smb':9A 'stall':8A","search_b":"'attack':57B 'beyond':59B 'caus':40B 'connect':42B 'deadlock':46B 'disrupt':60B 'expir':43B 'file':19B 'file-serv':18B 'gain':58B 'kernel':21B,34B 'ksmbd':22B,36B 'linux':23B,33B 'lock':28B 'lock-ord':27B 'order':29B 'problem':30B 'runtim':24B 'server':20B,38B,63B 'session':48B 'smb':25B,37B,62B 'sourc':51B 'state':54B 'teardown':49B 'worker':44B","search_c":"'acquisit':173C 'authent':95C 'behind':189C 'block':169C 'busi':82C,221C 'call':148C 'cannot':194C 'chang':99C 'check':93C,101C,213C 'conn':87C,105C,121C,151C,156C,165C,200C 'connect':76C,216C 'defer':75C 'destroy':113C,184C 'either':218C 'error':138C 'expir':84C 'follow':69C 'good':137C 'held':130C,182C 'hold':86C 'idl':123C 'instead':207C 'keep':214C 'kernel':67C 'ksmbd':74C,120C,135C,142C,149C 'later':228C 'let':223C 'linux':66C 'list':88C,157C,166C,201C 'lock':80C,89C,107C,111C,129C,158C,167C,181C,202C,206C,219C 'need':144C 'new':171C 'path':139C,147C 'period':225C 'previous':114C,185C 'proceed':195C 'queu':163C 'read':91C,160C,172C 'releas':199C 'resolv':73C 'retri':227C 'run':125C 'scaveng':77C,212C 'sess':124C,136C,143C 'session':79C,96C,106C,109C,115C,128C,180C,186C,205C 'set':152C 'setup':145C 'status':117C,153C 'success':146C 'tabl':110C 'take':155C 'tri':203C 'updat':118C 'vulner':70C 'wait':103C,122C,177C,188C,209C 'without':97C 'worker':85C,175C,198C,226C 'write':132C 'writer':162C,191C,193C","first_public_at":"2026-11-07T14:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99276","severity":null,"published_at":"2026-11-07T14:17:02+00:00","modified_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","fetched_at":"2026-11-07T14:47:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}