CVE-2026-99278

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99278", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-07T14:08:46.983Z", "dateUpdated": "2026-11-07T14:08:46.983Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-07T14:08:46.983Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: limit sessions on each connection\n\nThe pending setup limit only counts InProgress sessions. A client can\ncomplete authentication repeatedly and retain an unbounded number of Valid\nsessions on one connection.\n\nReserve a connection slot before allocating a session and retain a\nconnection reference while authentication is in progress. The first SMB3\nchannel takes over that reservation; binding to another connection reserves\none slot there. Reauthentication and authentication continuation reuse the\nexisting reservation. Return slots on allocation or insertion failure,\nchannel removal, and final session destruction.\n\nAccept max_sessions_per_connection in reserved startup-request space and\ndefault to 64 when older tools leave it zero. Keep the request size and\nexisting field offsets unchanged. Expose the configured limit in procfs.\nThe existing connection limits bound the aggregate number of sessions\nwithout a separate global session allocation limit."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/connection.c", "fs/smb/server/connection.h", "fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/user_session.c", "fs/smb/server/mgmt/user_session.h", "fs/smb/server/proc.c", "fs/smb/server/server.c", "fs/smb/server/server.h", "fs/smb/server/smb2pdu.c", "fs/smb/server/transport_ipc.c"], "versions": [{"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86", "lessThan": "94f8462fc9d5332bc54e91605003c17381e9171a", "status": "affected", "versionType": "git"}, {"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86", "lessThan": "dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68", "status": "affected", "versionType": "git"}, {"version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf", "status": "affected", "versionType": "git"}, {"version": "7.2.8", "lessThan": "7.3", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/connection.c", "fs/smb/server/connection.h", "fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/user_session.c", "fs/smb/server/mgmt/user_session.h", "fs/smb/server/proc.c", "fs/smb/server/server.c", "fs/smb/server/server.h", "fs/smb/server/smb2pdu.c", "fs/smb/server/transport_ipc.c"], "versions": [{"version": "7.3", "status": "affected"}, {"version": "0", "lessThan": "7.3", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.3", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.3", "versionEndExcluding": "7.4-rc1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/94f8462fc9d5332bc54e91605003c17381e9171a"}, {"url": "https://git.kernel.org/stable/c/dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68"}], "title": "ksmbd: limit sessions on each connection", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/connection.c", "fs/smb/server/connection.h", "fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/user_session.c", "fs/smb/server/mgmt/user_session.h", "fs/smb/server/proc.c", "fs/smb/server/server.c", "fs/smb/server/server.h", "fs/smb/server/smb2pdu.c", "fs/smb/server/transport_ipc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "94f8462fc9d5332bc54e91605003c17381e9171a", "status": "affected", "version": "d7fd1f98607f2cd358e583f9548bdf0173090a86", "versionType": "git"}, {"lessThan": "dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68", "status": "affected", "version": "d7fd1f98607f2cd358e583f9548bdf0173090a86", "versionType": "git"}, {"status": "affected", "version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf", "versionType": "git"}, {"lessThan": "7.3", "status": "affected", "version": "7.2.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/connection.c", "fs/smb/server/connection.h", "fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/user_session.c", "fs/smb/server/mgmt/user_session.h", "fs/smb/server/proc.c", "fs/smb/server/server.c", "fs/smb/server/server.h", "fs/smb/server/smb2pdu.c", "fs/smb/server/transport_ipc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.3"}, {"lessThan": "7.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: limit sessions on each connection\n\nThe pending setup limit only counts InProgress sessions. A client can\ncomplete authentication repeatedly and retain an unbounded number of Valid\nsessions on one connection.\n\nReserve a connection slot before allocating a session and retain a\nconnection reference while authentication is in progress. The first SMB3\nchannel takes over that reservation; binding to another connection reserves\none slot there. Reauthentication and authentication continuation reuse the\nexisting reservation. Return slots on allocation or insertion failure,\nchannel removal, and final session destruction.\n\nAccept max_sessions_per_connection in reserved startup-request space and\ndefault to 64 when older tools leave it zero. Keep the request size and\nexisting field offsets unchanged. Expose the configured limit in procfs.\nThe existing connection limits bound the aggregate number of sessions\nwithout a separate global session allocation limit."}], "id": "CVE-2026-99278", "lastModified": "2026-11-07T14:17:03.200", "metrics": {}, "published": "2026-11-07T14:17:03.200", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94f8462fc9d5332bc54e91605003c17381e9171a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: ksmbd: Denial of Service via unbounded sessions per connection", "id": "2568623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568623"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in the Linux kernel's ksmbd, an in-kernel SMB (Server Message Block) server. The session management mechanism only limited pending authentication attempts rather than enforcing a limit on established sessions per connection. A remote authenticated client could exploit this flaw by repeatedly completing authentication to retain an unbounded number of valid sessions on a single connection. This excessive allocation can exhaust system memory, leading to a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue on systems where the in-kernel SMB server is not needed, prevent the ksmbd kernel module from loading:\n1. Disable loading of the ksmbd module:\n# echo \"install ksmbd /bin/true\" > /etc/modprobe.d/disable-ksmbd.conf\n2. If the module is currently loaded, unload it:\n# modprobe -r ksmbd\nAlternatively, if ksmbd is run as a system service, stop and mask it:\n# systemctl stop ksmbd\n# systemctl mask ksmbd\nWarning: Unloading the module or stopping the service terminates all active SMB connections handled by ksmbd. If the kernel module is actively held in use by running processes, a system reboot may be required to completely unload it."}, "name": "CVE-2026-99278", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-07T14:08:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99278\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99278\nhttps://git.kernel.org/stable/c/94f8462fc9d5332bc54e91605003c17381e9171a\nhttps://git.kernel.org/stable/c/dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires an authenticated client with valid credentials and results strictly in resource exhaustion and denial of service, without impacting system confidentiality or integrity. In Red Hat Enterprise Linux environments, SMB file sharing is conventionally handled by user-space Samba implementations rather than the kernel-space ksmbd module, which is not activated in standard deployments. As a result, systems are only exposed if the administrator has intentionally enabled and configured the in-kernel SMB server.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d7fd1f98607f2cd358e583f9548bdf0173090a86,94f8462fc9d5332bc54e91605003c17381e9171a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d7fd1f98607f2cd358e583f9548bdf0173090a86,dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c99ea7855124ca1428a1e59c2b4590aaef34eacf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d7fd1f98607f2cd358e583f9548bdf0173090a86,94f8462fc9d5332bc54e91605003c17381e9171a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d7fd1f98607f2cd358e583f9548bdf0173090a86,dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c99ea7855124ca1428a1e59c2b4590aaef34eacf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-07T15:30:07.507382+00:00", "updated": "2026-11-08T01:30:18.807871+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}