CVE-2026-99277

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where the ksmbd session unregister() function removes a session from global and per-connection tables before dropping the table reference. This allows a concurrent reference holder to keep the session and its channel list active after removal. Because connection cleanup cannot find the unpublished session to remove its channels, and channels only store a raw connection pointer, the connection may be freed while still being accessed by another session reference holder, such as during a procfs read or SMB3.1.1 binding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.