CVE-2026-99278 in Linux
Summary
by MITRE • 11/07/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: limit sessions on each connection
The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection.
Reserve a connection slot before allocating a session and retain a connection reference while authentication is in progress. The first SMB3 channel takes over that reservation; binding to another connection reserves one slot there. Reauthentication and authentication continuation reuse the existing reservation. Return slots on allocation or insertion failure, channel removal, and final session destruction.
Accept max_sessions_per_connection in reserved startup-request space and default to 64 when older tools leave it zero. Keep the request size and existing field offsets unchanged. Expose the configured limit in procfs. The existing connection limits bound the aggregate number of sessions without a separate global session allocation limit.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability identified within the Linux kernel's ksmbd component stems from an insufficient validation mechanism regarding session management on individual SMB connections. Specifically, the pending setup limit was designed to count only InProgress sessions, which created a logical gap allowing clients to exploit this oversight. By repeatedly completing authentication processes without properly releasing or limiting the resulting state, a malicious client could establish and retain an unbounded number of Valid sessions on a single connection. This behavior effectively bypasses intended resource controls, leading to potential denial-of-service conditions through excessive memory consumption or system instability due to the exhaustion of kernel resources associated with session tracking structures.
The technical flaw resides in the allocation logic for SMB3 connections where session slots were not reserved prior to authentication attempts. Without a reservation mechanism, there was no enforcement point to prevent a single connection from spawning an infinite number of authenticated sessions. The resolution involves implementing a strict reservation protocol where a connection slot is secured before any session allocation occurs. During this process, the system retains a reference to the connection while authentication is in progress, ensuring that resources are accounted for immediately upon initiation rather than after completion. This approach ensures that the first SMB3 channel takes over the reserved slot, and binding to another connection reserves one slot there as well. Reauthentication and continuation of authentication reuse this existing reservation, preventing redundant allocations while maintaining state integrity throughout the lifecycle of the session establishment process.
To further mitigate risks associated with legacy clients or tools that may not support newer protocol features, the fix introduces a configuration parameter for max_sessions_per_connection within the reserved startup-request space. This value defaults to sixty-four when older tools leave it at zero, ensuring backward compatibility while enforcing reasonable limits on modern implementations. The request size and existing field offsets remain unchanged to preserve binary interface stability. Additionally, the configured limit is exposed through procfs, allowing administrators to monitor current session constraints and verify that enforcement mechanisms are active. This visibility aids in operational oversight and troubleshooting of connection-related issues without requiring kernel recompilation or module reloading.
The impact of this vulnerability extends beyond simple resource exhaustion. An unbounded number of sessions can lead to significant performance degradation as the kernel must manage an ever-growing list of session contexts, potentially impacting other network services running on the same host. In severe cases, this could result in a complete system hang or crash if memory allocation fails due to fragmentation or total depletion. From a security operations perspective, such vulnerabilities are often leveraged for reconnaissance purposes, where attackers use multiple sessions to probe for additional weaknesses across different shares and permissions simultaneously. The fix aligns with industry standards by addressing CWE-787: Out-of-bounds Write in terms of resource management logic and mitigating techniques associated with ATT&CK T1496: Resource Hijacking, specifically through the prevention of unauthorized resource consumption that could disrupt service availability.
Mitigation strategies involve applying the kernel patch that enforces these session limits immediately upon connection establishment. Administrators should ensure their systems are updated to versions containing this fix and verify that the max_sessions_per_connection parameter is correctly configured in production environments. Regular auditing of active SMB sessions can help detect anomalous behavior indicative of exploitation attempts before they reach critical thresholds. Furthermore, network-level controls such as rate limiting on SMB ports can provide an additional layer of defense against automated attacks attempting to flood connections with authentication requests. By combining kernel-level fixes with operational monitoring and network security policies, organizations can effectively neutralize the risk posed by this session management flaw in ksmbd.