CVE-2026-52911

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52911", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.366Z", "datePublished": "2026-06-21T06:18:49.342Z", "dateUpdated": "2026-08-05T12:31:34.753Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:34.753Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: scope conn->binding slowpath to bound sessions only\n\nWhen the binding SESSION_SETUP sets conn->binding = true, the flag stays\nset after the call so that the global session lookup in\nksmbd_session_lookup_all() can find the session, which was not added to\nconn->sessions. Because the flag is connection-wide, the global lookup\npath will also resolve any other session by id if asked.\n\nTighten the global lookup so that the returned session must have this\nconnection registered in its channel xarray (sess->ksmbd_chann_list).\nThe channel entry is installed by the existing binding_session path in\nntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes\nsuccessfully, so this condition is a strict equivalent of \"this\nconnection has been accepted as a channel of this session\". Connections\nthat have not bound to a given session cannot reach it via the global\ntable.\n\nThe existing conn->binding gate for entering the slowpath is preserved\nso that non-binding connections keep the fast-path-only behavior, and\nthe session->state check is unchanged."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - ksmbd is an in-kernel SMB server reachable over the network via SMB over TCP/RDMA, and the vulnerable session lookup is reached while processing remote SMB2/SMB3 requests.\nAC:L - After a successful SMB3 multichannel binding, the connection-wide binding flag remains set and the attacker can send ordinary subsequent SMB requests with chosen SessionIds. Session and tree IDs are low allocated identifiers, and no condition outside attacker control is required for the vulnerable lookup once binding state is established.\nPR:L - The durable exploit path requires the attacker to authenticate and successfully perform a non-guest multichannel binding SESSION_SETUP, which requires a valid low-privileged SMB account/session. The fixed issue is post-success binding state rather than a purely pre-authentication path.\nUI:N - No victim user action is required; the attacker sends SMB protocol messages directly to the ksmbd service.\nS:U - The impact remains within the kernel/ksmbd server security authority and exposed SMB resources. It does not cross a hypervisor, sandbox, or other separate security authority boundary.\nC:H - The bug allows a bound connection to resolve unrelated valid sessions by ID from the global session table, enabling access as another SMB session/user. In a reasonable deployment this can expose all files and share data accessible to the victim session.\nI:H - By obtaining another user's session context, the attacker can perform SMB operations as that user, including writes, deletes, metadata changes, or administrative IPC allowed to the victim. This is a high integrity impact on SMB-served data.\nA:H - The attacker can issue operations such as LOGOFF or destructive file/share operations against other resolved sessions, disrupting victim access and SMB-served data availability. This can be repeated remotely against the service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "versions": [{"version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "e74c00c6af428a39e564cdc5bd3a3648c6d8de87", "status": "affected", "versionType": "git"}, {"version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a", "status": "affected", "versionType": "git"}, {"version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "1ff46c9915c1cbf454db58a8cb87f7cac818e6a6", "status": "affected", "versionType": "git"}, {"version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "974c1c224e85549dc3459f3bb2255bbbdd2b9372", "status": "affected", "versionType": "git"}, {"version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "2cc8a4db633b10715450b291c1343859a4b2c509", "status": "affected", "versionType": "git"}, {"version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "1e2bec062c5c9ec282636715166056d0998d746d", "status": "affected", "versionType": "git"}, {"version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "b0da97c034b6107d14e537e212d4ce8b22109a58", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e74c00c6af428a39e564cdc5bd3a3648c6d8de87"}, {"url": "https://git.kernel.org/stable/c/e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a"}, {"url": "https://git.kernel.org/stable/c/1ff46c9915c1cbf454db58a8cb87f7cac818e6a6"}, {"url": "https://git.kernel.org/stable/c/974c1c224e85549dc3459f3bb2255bbbdd2b9372"}, {"url": "https://git.kernel.org/stable/c/2cc8a4db633b10715450b291c1343859a4b2c509"}, {"url": "https://git.kernel.org/stable/c/1e2bec062c5c9ec282636715166056d0998d746d"}, {"url": "https://git.kernel.org/stable/c/b0da97c034b6107d14e537e212d4ce8b22109a58"}], "title": "ksmbd: scope conn->binding slowpath to bound sessions only", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e74c00c6af428a39e564cdc5bd3a3648c6d8de87", "status": "affected", "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "versionType": "git"}, {"lessThan": "e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a", "status": "affected", "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "versionType": "git"}, {"lessThan": "1ff46c9915c1cbf454db58a8cb87f7cac818e6a6", "status": "affected", "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "versionType": "git"}, {"lessThan": "974c1c224e85549dc3459f3bb2255bbbdd2b9372", "status": "affected", "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "versionType": "git"}, {"lessThan": "2cc8a4db633b10715450b291c1343859a4b2c509", "status": "affected", "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "versionType": "git"}, {"lessThan": "1e2bec062c5c9ec282636715166056d0998d746d", "status": "affected", "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "versionType": "git"}, {"lessThan": "b0da97c034b6107d14e537e212d4ce8b22109a58", "status": "affected", "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EDF0B07-5AB8-46F1-84C6-AAB5EF2C52B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97A9FFFA-22BB-4D5C-9790-5A2286E392F7", "versionEndExcluding": "6.6.141", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: scope conn->binding slowpath to bound sessions only\n\nWhen the binding SESSION_SETUP sets conn->binding = true, the flag stays\nset after the call so that the global session lookup in\nksmbd_session_lookup_all() can find the session, which was not added to\nconn->sessions. Because the flag is connection-wide, the global lookup\npath will also resolve any other session by id if asked.\n\nTighten the global lookup so that the returned session must have this\nconnection registered in its channel xarray (sess->ksmbd_chann_list).\nThe channel entry is installed by the existing binding_session path in\nntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes\nsuccessfully, so this condition is a strict equivalent of \"this\nconnection has been accepted as a channel of this session\". Connections\nthat have not bound to a given session cannot reach it via the global\ntable.\n\nThe existing conn->binding gate for entering the slowpath is preserved\nso that non-binding connections keep the fast-path-only behavior, and\nthe session->state check is unchanged."}], "id": "CVE-2026-52911", "lastModified": "2026-07-08T15:13:12.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-21T08:16:23.607", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1e2bec062c5c9ec282636715166056d0998d746d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1ff46c9915c1cbf454db58a8cb87f7cac818e6a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2cc8a4db633b10715450b291c1343859a4b2c509"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/974c1c224e85549dc3459f3bb2255bbbdd2b9372"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b0da97c034b6107d14e537e212d4ce8b22109a58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e74c00c6af428a39e564cdc5bd3a3648c6d8de87"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: scope conn->binding slowpath to bound sessions only", "id": "2491128", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491128"}, "csaw": false, "cwe": "CWE-488", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nksmbd: scope conn->binding slowpath to bound sessions only\nWhen the binding SESSION_SETUP sets conn->binding = true, the flag stays\nset after the call so that the global session lookup in\nksmbd_session_lookup_all() can find the session, which was not added to\nconn->sessions. Because the flag is connection-wide, the global lookup\npath will also resolve any other session by id if asked.\nTighten the global lookup so that the returned session must have this\nconnection registered in its channel xarray (sess->ksmbd_chann_list).\nThe channel entry is installed by the existing binding_session path in\nntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes\nsuccessfully, so this condition is a strict equivalent of \"this\nconnection has been accepted as a channel of this session\". Connections\nthat have not bound to a given session cannot reach it via the global\ntable.\nThe existing conn->binding gate for entering the slowpath is preserved\nso that non-binding connections keep the fast-path-only behavior, and\nthe session->state check is unchanged.", "A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an attacker to gain unauthorized access to session information or resources by exploiting an improper scope in the session binding mechanism. This could potentially compromise the integrity or confidentiality of data within affected sessions."], "name": "CVE-2026-52911", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52911\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52911\nhttps://lore.kernel.org/linux-cve-announce/2026062146-CVE-2026-52911-fab1@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f5a544e3bab78142207e0242d22442db85ba1eff,e74c00c6af428a39e564cdc5bd3a3648c6d8de87)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f5a544e3bab78142207e0242d22442db85ba1eff,e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f5a544e3bab78142207e0242d22442db85ba1eff,1ff46c9915c1cbf454db58a8cb87f7cac818e6a6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f5a544e3bab78142207e0242d22442db85ba1eff,974c1c224e85549dc3459f3bb2255bbbdd2b9372)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f5a544e3bab78142207e0242d22442db85ba1eff,2cc8a4db633b10715450b291c1343859a4b2c509)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f5a544e3bab78142207e0242d22442db85ba1eff,1e2bec062c5c9ec282636715166056d0998d746d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f5a544e3bab78142207e0242d22442db85ba1eff,b0da97c034b6107d14e537e212d4ce8b22109a58)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.209,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.175,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.141,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-21T10:00:06.681540+00:00", "updated": "2026-08-12T05:45:04.240668+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}