{"id":"CVE-2026-99277","published":"2026-11-07T14:17:03.080","lastModified":"2026-11-10T17:17:57.803","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: hold a connection reference for each session channel\n\nksmbd_session_unregister() removes a session from the global and per-\nconnection tables before dropping the table reference. A concurrent\nreference holder can keep the session and its channel list alive after\nthose removals.\n\nConnection cleanup can no longer find the unpublished session to remove its\nchannels. Since a channel only stores a raw conn pointer, the connection\ncan be freed while another session reference holder is still accessing it,\nfor example during SMB3.1.1 binding or a procfs read.\n\nTake a connection reference when registering a channel and release it on\ninsertion failure, channel removal, or final session destruction. Keep the\nchannels and signing keys until the session is destroyed so a response can\nstill be signed after the session has been unregistered.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/4b333aed69cfc2c8687b86b6a4364a0dffc16dd8","tags":[]},{"url":"https://git.kernel.org/stable/c/add8d7fb04efe564193df73581889c62fc0016f1","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}