CVE-2026-99277 in Linux
Summary
by MITRE • 11/07/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: hold a connection reference for each session channel
ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals.
Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read.
Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability identified in the Linux kernel's ksmbd module represents a critical use-after-free condition arising from improper reference counting during session teardown operations. Specifically, the function ksmbd_session_unregister() was designed to remove sessions from global and per-connection tables before releasing the associated table references. This ordering created a race window where concurrent threads holding their own references to the same session could continue accessing it even after its structural removal from management structures. The core technical flaw lies in the fact that connection cleanup routines rely on these tables to locate unpublished sessions for proper channel teardown, but once the session is removed prematurely, those cleanup mechanisms fail to identify and release associated resources.
This architectural oversight leads directly to a scenario where memory allocated for network connections can be freed while still being actively accessed by other parts of the system. The ksmbd module manages SMB protocol channels which store raw pointers to connection structures rather than reference-counted objects. When a session is unregistered, if another thread holds a valid reference and attempts operations such as SMB3.1.1 binding or reading from procfs interfaces, it may dereference memory that has already been deallocated by the cleanup routine. This results in undefined behavior, potential kernel panics due to invalid memory access, or more severely, arbitrary code execution if an attacker can control the data written into the freed memory region before it is reallocated for another purpose.
From a security classification perspective, this vulnerability aligns with CWE-416, Use After Free, as the system attempts to use pointers to objects that have already been deallocated. The attack vector typically involves triggering concurrent session unregistration and access patterns, which may be achievable through crafted SMB requests or by exploiting timing conditions in multi-threaded environments handling multiple client connections. In terms of MITRE ATT&CK mapping, this falls under T1203 Exploitation for Defense Evasion if used to crash the system, but more critically relates to privilege escalation vectors where kernel memory corruption allows gaining higher privileges on the host system. The impact extends beyond simple denial of service; successful exploitation could allow remote attackers to execute arbitrary code with root-level privileges within the Linux kernel space.
The resolution implemented in this patch addresses the race condition by enforcing strict reference counting semantics for connection objects throughout their lifecycle. When a channel is registered, it now acquires a reference count on its underlying connection structure, ensuring that the memory remains valid as long as any active session or channel references exist. This reference is explicitly released only upon insertion failure, explicit channel removal, or final session destruction when no other entities hold dependencies. Additionally, the patch ensures that channels and their associated signing keys are retained until complete session teardown rather than being prematurely discarded during unregistration phases.
This mitigation strategy guarantees that response signing operations remain functional even after a session has been logically unregistered from management tables but before all physical resources have been safely reclaimed. By maintaining these references correctly, the kernel prevents the scenario where cleanup routines attempt to access freed memory structures. System administrators should ensure their Linux distributions are updated with this patch applied to ksmbd components. Regular security audits focusing on concurrent access patterns in network file sharing services can help identify similar reference counting issues before they manifest as exploitable vulnerabilities in production environments.