Session Channel Vulnerability in Linux Kernel by Linux Foundation

CVE-2026-99277

What is CVE-2026-99277?

A vulnerability in the Linux kernel's ksmbd component allows an attacker to retain a connection reference for each session channel even after the session is unregistered. This improper session handling can lead to scenarios where the connection cleanup fails to remove channels, resulting in potential unauthorized access or resource leaks. To mitigate this risk, it's essential to take a connection reference during channel registration and ensure proper cleanup protocols are followed during session destruction.

References