{"id":"CVE-2026-99277","kind":"vulnerability","aliases":["CVE-2026-99277"],"related":[],"title":"Linux kernel: ksmbd session cleanup can free a connection still in use","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: hold a connection reference for each session channel\n\nksmbd_session_unregister() removes a session from the global and per-\nconnection tables before dropping the table reference. A concurrent\nreference holder can keep the session and its channel list alive after\nthose removals.\n\nConnection cleanup can no longer find the unpublished session to remove its\nchannels. Since a channel only stores a raw conn pointer, the connection\ncan be freed while another session reference holder is still accessing it,\nfor example during SMB3.1.1 binding or a procfs read.\n\nTake a connection reference when registering a channel and release it on\ninsertion failure, channel removal, or final session destruction. Keep the\nchannels and signing keys until the session is destroyed so a response can\nstill be signed after the session has been unregistered.","summary":"A race in the Linux kernel's ksmbd SMB server lets a connection be freed while another session reference still uses it. The sources do not state what an attacker gets beyond a crash or memory misuse in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-server","kernel","ksmbd","linux","runtime","smb"],"not_affected_if":["ksmbd-not-loaded","samba-only"],"how_to_check":"- Check whether the kernel was built with ksmbd: `grep -i ksmbd /boot/config-$(uname -r)` (CONFIG_SMB_SERVER set)\n- Check whether the ksmbd service is running: `lsmod | grep ksmbd`","fix":null,"status":"open","published_at":"2026-11-07T14:17:03+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","triaged_at":"2026-11-07T14:49:53+00:00","updated_at":"2026-11-07T14:49:53+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-07T14:49:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel: ksmbd session cleanup can free a connection still in use","impact":"high","summary":"A race in the Linux kernel's ksmbd SMB server lets a connection be freed while another session reference still uses it. The sources do not state what an attacker gets beyond a crash or memory misuse in the kernel.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","kernel","ksmbd","smb","file-server"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel memory corruption from a use-after-free, possibly code execution","analyst_note":"Find the affected and fixed kernel versions and whether pre-auth SMB traffic reaches the race, via the kernel.org stable commit for this ksmbd fix.","how_to_check":"- Check whether the kernel was built with ksmbd: `grep -i ksmbd /boot/config-$(uname -r)` (CONFIG_SMB_SERVER set)\n- Check whether the ksmbd service is running: `lsmod | grep ksmbd`\n- unknown for the exact affected kernel versions","plain_action":"","needs_analyst":true,"not_affected_if":["ksmbd-not-loaded","samba-only"],"who_is_affected":"Only systems running the Linux kernel's ksmbd SMB server are exposed, since it is the code path that registers session channels. Machines that do not load ksmbd, or that run Samba instead, can skip it. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000732,"input_tokens":4388,"output_tokens":586,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99277':15A,18A 'access':154C 'aliv':116C 'anoth':43B,148C 'attack':56B 'beyond':58B 'bind':160C 'channel':85C,114C,132C,135C,172C,179C,187C 'cleanup':5A,121C 'concurr':105C 'conn':140C 'connect':9A,39B,80C,97C,120C,143C,167C 'crash':60B 'cve':13A,16A 'destroy':195C 'destruct':184C 'drop':100C 'exampl':157C 'failur':178C 'file':20B 'file-serv':19B 'final':182C 'find':125C 'follow':72C 'free':7A 'freed':41B,146C 'get':57B 'global':94C 'hold':78C 'holder':107C,151C 'insert':177C 'keep':109C,185C 'kernel':2A,22B,32B,66B,70C 'key':190C 'ksmbd':3A,23B,34B,77C,86C 'let':37B 'linux':1A,24B,31B,69C 'list':115C 'longer':124C 'memori':62B 'misus':63B 'per':96C 'pointer':141C 'procf':163C 'race':28B 'raw':139C 'read':164C 'refer':45B,81C,103C,106C,150C,168C 'regist':170C 'releas':174C 'remov':89C,119C,130C,180C 'resolv':76C 'respons':198C 'runtim':25B 'server':21B,36B 'session':4A,44B,84C,87C,91C,111C,128C,149C,183C,193C,205C 'sign':189C,202C 'sinc':133C 'smb':26B,35B 'smb3.1.1':159C 'sourc':50B 'state':53B 'still':10A,46B,153C,200C 'store':137C 'tabl':98C,102C 'take':165C 'unpublish':127C 'unregist':88C,208C 'use':12A,47B 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Only systems running the Linux kernel's ksmbd SMB server are exposed, since it is the code path that registers session channels. Machines that do not load ksmbd, or that run Samba instead, can skip it. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fileserver","kernel","ksmbd","linux","runtime","smb","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-99277':15A,18A 'cleanup':5A 'connect':9A 'cve':13A,16A 'free':7A 'kernel':2A 'ksmbd':3A 'linux':1A 'session':4A 'still':10A 'use':12A","search_b":"'anoth':43B 'attack':56B 'beyond':58B 'connect':39B 'crash':60B 'file':20B 'file-serv':19B 'freed':41B 'get':57B 'kernel':22B,32B,66B 'ksmbd':23B,34B 'let':37B 'linux':24B,31B 'memori':62B 'misus':63B 'race':28B 'refer':45B 'runtim':25B 'server':21B,36B 'session':44B 'smb':26B,35B 'sourc':50B 'state':53B 'still':46B 'use':47B","search_c":"'access':154C 'aliv':116C 'anoth':148C 'bind':160C 'channel':85C,114C,132C,135C,172C,179C,187C 'cleanup':121C 'concurr':105C 'conn':140C 'connect':80C,97C,120C,143C,167C 'destroy':195C 'destruct':184C 'drop':100C 'exampl':157C 'failur':178C 'final':182C 'find':125C 'follow':72C 'freed':146C 'global':94C 'hold':78C 'holder':107C,151C 'insert':177C 'keep':109C,185C 'kernel':70C 'key':190C 'ksmbd':77C,86C 'linux':69C 'list':115C 'longer':124C 'per':96C 'pointer':141C 'procf':163C 'raw':139C 'read':164C 'refer':81C,103C,106C,150C,168C 'regist':170C 'releas':174C 'remov':89C,119C,130C,180C 'resolv':76C 'respons':198C 'session':84C,87C,91C,111C,128C,149C,183C,193C,205C 'sign':189C,202C 'sinc':133C 'smb3.1.1':159C 'still':153C,200C 'store':137C 'tabl':98C,102C 'take':165C 'unpublish':127C 'unregist':88C,208C 'vulner':73C","first_public_at":"2026-11-07T14:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99277","severity":null,"published_at":"2026-11-07T14:17:03+00:00","modified_at":"2026-11-07T14:17:03+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","fetched_at":"2026-11-07T14:47:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}