CVE-2026-90154

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where the ksmbd all conn set status() function incorrectly treats every connection with a set transient binding flag as belonging to the target SessionId. This can cause a logoff or session replacement to erroneously move unrelated connections to NEED RECONNECT or NEED SETUP states. The fix involves passing the target session and selecting connections via the connection-local session xarray or the session's permanent channel list, while serializing session-wide status changes under request lock to prevent overwriting EXITING or RELEASING states and protecting the shutdown transition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.