CVE-2026-90152 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix session leak in ksmbd_session_register()
See the procedure below:
smb2_sess_setup ksmbd_smb2_session_create __session_create atomic_set(&sess->refcnt, 2) hash_add(sessions_table, &sess->hlist, sess->id) ksmbd_session_register xa_store(&conn->sessions, sess->id, sess) // fail ksmbd_user_session_put atomic_dec(&sess->refcnt) // refcnt is 1, session is not freed
Remove the session from sessions_table and drop its table reference if xa_store() fails.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel involves a resource management flaw within the ksmbd server implementation, specifically during the registration of SMB2 sessions. This issue arises in the interaction between the session creation logic and the subsequent registration process with connection-specific data structures. The core technical flaw is located in the ksmbd_session_register function, which attempts to store a newly created session object into an XArray associated with the current connection using xa_store. When this operation fails due to memory allocation issues or other internal errors, the code path invokes ksmbd_user_session_put to decrement the reference count of the session object. However, prior steps in the creation sequence have already added the session to a global sessions_table via hash_add and initialized its reference counter with atomic_set(&sess->refcnt, 2). Consequently, when the registration fails and the put function executes, it only decrements the reference count from two to one rather than freeing the object. This leaves the session in an inconsistent state where it remains registered in the global sessions_table but is no longer properly tracked by the connection structure that initiated its creation.
This logic error results in a persistent memory leak and potential resource exhaustion over time. Because the session entry persists in the hash table without being removed, each failed registration attempt consumes kernel memory resources associated with the session object and its metadata. In scenarios where an attacker can trigger repeated failures of xa_store, such as by exhausting available memory or manipulating connection states to force allocation errors, this vulnerability can be exploited to degrade system performance significantly. The accumulation of these orphaned sessions contributes to a denial of service condition, potentially rendering the SMB server unresponsive due to resource saturation. Furthermore, stale entries in the session table may interfere with subsequent authentication attempts or lead to unpredictable behavior when the kernel iterates over active sessions for cleanup or state management operations.
From an industry standards perspective, this vulnerability aligns closely with CWE-401, which describes a missing release of memory after effective usage, and CWE-772, referring to Missing Release of Resource after Effective Lifetime. The failure to properly clean up the session from the global hash table upon registration failure represents a classic case of improper resource lifecycle management. In terms of attack vectors, this flaw could be leveraged within the context of ATT&CK technique T1496, or Resource Hijacking, where an adversary consumes system resources to disrupt availability. Although ksmbd is primarily used in enterprise environments for file sharing across heterogeneous platforms, its exposure makes it a potential target for remote exploitation if accessible over network interfaces without adequate access controls.
Mitigation strategies should focus on ensuring that all allocated resources are correctly released regardless of the outcome of subsequent operations. The primary fix involves modifying the error handling path within ksmbd_session_register to explicitly remove the session from the sessions_table and drop its reference count appropriately when xa_store fails. This ensures that no orphaned entries remain in the global hash table, thereby preventing memory leaks. Administrators should apply kernel updates that include this patch as soon as they become available through their distribution channels. Additionally, monitoring for unusual spikes in memory usage associated with SMB services can help detect potential exploitation attempts before they lead to service disruption. Implementing strict rate limiting on authentication requests and ensuring proper network segmentation further reduces the risk of abuse by external actors seeking to trigger resource exhaustion conditions.