CVE-2026-99276

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99276", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-07T14:08:46.432Z", "dateUpdated": "2026-11-07T14:08:46.432Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-07T14:08:46.432Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: defer connection scavenging while session locks are busy\n\nThe expiration worker holds conn_list_lock for reading while checking\nfor authenticated sessions. Without this change, the check can wait for\nconn->session_lock or sessions_table_lock.\n\nIn destroy_previous_session(), the status updates after\nksmbd_conn_wait_idle_sess() run with both session locks held for\nwriting. Both the KSMBD_SESS_GOOD error path and the\nKSMBD_SESS_NEED_SETUP success path call ksmbd_all_conn_set_status(),\nwhich takes conn_list_lock for reading.\n\nA writer queued on conn_list_lock can block these new read acquisitions.\nThe worker then waits for a session lock held by\ndestroy_previous_session(), which waits behind the writer. The writer\ncannot proceed until the worker releases conn_list_lock.\n\nTry both session locks instead of waiting in the scavenging check. Keep\nthe connection when either lock is busy and let the periodic worker\nretry later."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "versions": [{"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86", "lessThan": "4e4e8b38994a0b0fc23f00ca6698b469a41abe70", "status": "affected", "versionType": "git"}, {"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86", "lessThan": "b4bae7af1154089be87c7475218264fcbfd16d10", "status": "affected", "versionType": "git"}, {"version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf", "status": "affected", "versionType": "git"}, {"version": "7.2.8", "lessThan": "7.3", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "versions": [{"version": "7.3", "status": "affected"}, {"version": "0", "lessThan": "7.3", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.3", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.3", "versionEndExcluding": "7.4-rc1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4e4e8b38994a0b0fc23f00ca6698b469a41abe70"}, {"url": "https://git.kernel.org/stable/c/b4bae7af1154089be87c7475218264fcbfd16d10"}], "title": "ksmbd: defer connection scavenging while session locks are busy", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4e4e8b38994a0b0fc23f00ca6698b469a41abe70", "status": "affected", "version": "d7fd1f98607f2cd358e583f9548bdf0173090a86", "versionType": "git"}, {"lessThan": "b4bae7af1154089be87c7475218264fcbfd16d10", "status": "affected", "version": "d7fd1f98607f2cd358e583f9548bdf0173090a86", "versionType": "git"}, {"status": "affected", "version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf", "versionType": "git"}, {"lessThan": "7.3", "status": "affected", "version": "7.2.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.3"}, {"lessThan": "7.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: defer connection scavenging while session locks are busy\n\nThe expiration worker holds conn_list_lock for reading while checking\nfor authenticated sessions. Without this change, the check can wait for\nconn->session_lock or sessions_table_lock.\n\nIn destroy_previous_session(), the status updates after\nksmbd_conn_wait_idle_sess() run with both session locks held for\nwriting. Both the KSMBD_SESS_GOOD error path and the\nKSMBD_SESS_NEED_SETUP success path call ksmbd_all_conn_set_status(),\nwhich takes conn_list_lock for reading.\n\nA writer queued on conn_list_lock can block these new read acquisitions.\nThe worker then waits for a session lock held by\ndestroy_previous_session(), which waits behind the writer. The writer\ncannot proceed until the worker releases conn_list_lock.\n\nTry both session locks instead of waiting in the scavenging check. Keep\nthe connection when either lock is busy and let the periodic worker\nretry later."}], "id": "CVE-2026-99276", "lastModified": "2026-11-07T14:17:02.967", "metrics": {}, "published": "2026-11-07T14:17:02.967", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4e4e8b38994a0b0fc23f00ca6698b469a41abe70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b4bae7af1154089be87c7475218264fcbfd16d10"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service in ksmbd via deadlock during session cleanup", "id": "2568631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568631"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["A flaw was found in the Linux kernel's ksmbd (Server Message Block) server. A remote client can cause a Denial of Service (DoS) by triggering a deadlock condition during concurrent session teardown and connection cleanup operations. Because the periodic connection cleanup worker and session termination routines acquire internal locks in conflicting orders, simultaneous requests can become permanently blocked, causing the server to hang."], "mitigation": {"lang": "en:us", "value": "If the in-kernel SMB server is not required, prevent the system from loading the ksmbd kernel module by adding a configuration rule:\n```\n# echo \"install ksmbd /bin/true\" > /etc/modprobe.d/ksmbd.conf\n```\nIf the module is currently loaded, stop any active ksmbd services and unload the module:\n```\n# modprobe -r ksmbd\n```\nWarning: Unloading the kernel module or restricting service access will terminate active SMB sessions and prevent file sharing via ksmbd. If the module cannot be immediately unloaded because it is in use, a system reboot is required for the blacklist configuration to take effect. If ksmbd is required in your environment, restrict incoming network access to trusted hosts using firewall rules."}, "name": "CVE-2026-99276", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-07T14:08:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99276\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99276\nhttps://git.kernel.org/stable/c/4e4e8b38994a0b0fc23f00ca6698b469a41abe70\nhttps://git.kernel.org/stable/c/b4bae7af1154089be87c7475218264fcbfd16d10"], "statement": "This vulnerability is assessed with a Moderate impact because a deadlock can trigger a denial of service without compromising system confidentiality or integrity. Exploitation requires specific race conditions between simultaneous session termination and connection scavenging on an actively serving kernel SMB instance. Red Hat Enterprise Linux relies on userspace Samba by default for SMB file sharing, meaning the in-kernel ksmbd server is not running or enabled on standard configurations.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d7fd1f98607f2cd358e583f9548bdf0173090a86,4e4e8b38994a0b0fc23f00ca6698b469a41abe70)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d7fd1f98607f2cd358e583f9548bdf0173090a86,b4bae7af1154089be87c7475218264fcbfd16d10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c99ea7855124ca1428a1e59c2b4590aaef34eacf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d7fd1f98607f2cd358e583f9548bdf0173090a86,4e4e8b38994a0b0fc23f00ca6698b469a41abe70)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d7fd1f98607f2cd358e583f9548bdf0173090a86,b4bae7af1154089be87c7475218264fcbfd16d10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c99ea7855124ca1428a1e59c2b4590aaef34eacf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-07T16:00:17.567925+00:00", "updated": "2026-11-08T01:30:18.809378+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-368", "CWE-833"]}