Linux Kernel Vulnerability in ksmbd Affecting Session Binding

CVE-2026-52911

What is CVE-2026-52911?

A vulnerability in the Linux kernel's ksmbd module increases the risk of unauthorized session access. When a SESSION_SETUP command modifies the connection's binding flag, it inadvertently allows a global session lookup to potentially match sessions not actually associated with the connection. This occurs because the conn->binding flag remains active after the call, leading to insecure session handling. The mitigation restricts the session lookup, ensuring that only sessions bound to the specific connection can be resolved, enhancing overall session integrity and security.

References