Session Management Vulnerabilities in Linux Kernel by Linux Foundation

CVE-2026-99279

What is CVE-2026-99279?

A session management vulnerability exists within the Linux kernel where ended sessions remain in memory, retaining crucial resources and not properly expiring credentials. This flaw allows logged-off sessions to preserve response signing and encryption keys, leading to a potential risk of unauthorized access. The issue primarily revolves around the management of session expiry, requiring proper reclamation from global tables and ensuring that expired sessions do not persist beyond their intended lifecycle. Without adequate disposal, weakened session handling can expose systems to attack, especially concerning SMB2 and SMB3 channel connections.

References