---
id: "CVE-2026-99279"
page: "https://infrastack.ai/live/CVE-2026-99279"
kind: "vulnerability"
aliases: ["CVE-2026-99279"]
title: "Linux kernel ksmbd: ended SMB sessions keep memory and connection slots"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ksmbd", "linux", "runtime", "self-hosted", "smb"]
not_affected_if: ["ksmbd-not-loaded"]
published_at: "2026-11-07T14:17:03+00:00"
first_seen_at: "2026-11-07T14:47:40+00:00"
updated_at: "2026-11-07T14:49:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99279", "first_seen_at": "2026-11-07T14:47:40+00:00"}]
exploit_sources: []
---

# Linux kernel ksmbd: ended SMB sessions keep memory and connection slots

Link for people: https://infrastack.ai/live/CVE-2026-99279 (this .md is for agents)

In the Linux kernel's ksmbd SMB file server, sessions that were logged off or replaced are not released when no further setup arrives on their connection. The leftover sessions keep their memory and connection slots, which can exhaust server resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the kernel has the ksmbd module loaded: `lsmod | grep ksmbd`
- Check the running kernel version: `uname -r`

## Timeline

- 2026-11-07T14:47:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99279

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: reclaim ended sessions on logoff and expiration

LOGOFF and previous-session replacement leave sessions Expired with a
zero credential expiry. Ended sessions can retain their memory and
connection slots when no further setup arrives on the owning connection.

Unpublish a logged-off session while the request reference keeps its
response signing and encryption keys alive. Remove its procfs entry
before dropping the table reference so a reader cannot remove its own
entry on the last put. Clear proc_entry after removal to avoid removing
it twice.

Reclaim ended sessions from the global table in the existing expiration
worker before it acquires conn_list_lock. Only select Expired sessions
with zero credential expiry and no references beyond the table
reference. Keep sessions whose Kerberos credentials expired available
for reauthentication.

Unlink the session from its setup connection and all channel
connections, so SMB2 sessions and sessions with only secondary SMB3
channels are covered. The session already holds connection references,
and sessions_table_lock prevents concurrent channel removal. Queue
sessions on a separate disposal list, leaving their hash nodes unhashed,
and remove procfs entries and drop table references outside the locks.

Keep the pending setup check before allocating a new session so
abandoned InProgress sessions can release their slots even at the
connection limit. Retain the timeout and reference checks and dispose of
those sessions outside the locks. Leave ended Expired sessions to the
expiration worker.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_