CVE-2026-99279 in Linux
Summary
by MITRE • 11/07/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reclaim ended sessions on logoff and expiration
LOGOFF and previous-session replacement leave sessions Expired with a zero credential expiry. Ended sessions can retain their memory and connection slots when no further setup arrives on the owning connection.
Unpublish a logged-off session while the request reference keeps its response signing and encryption keys alive. Remove its procfs entry before dropping the table reference so a reader cannot remove its own entry on the last put. Clear proc_entry after removal to avoid removing it twice.
Reclaim ended sessions from the global table in the existing expiration worker before it acquires conn_list_lock. Only select Expired sessions with zero credential expiry and no references beyond the table reference. Keep sessions whose Kerberos credentials expired available for reauthentication.
Unlink the session from its setup connection and all channel connections, so SMB2 sessions and sessions with only secondary SMB3 channels are covered. The session already holds connection references, and sessions_table_lock prevents concurrent channel removal. Queue sessions on a separate disposal list, leaving their hash nodes unhashed, and remove procfs entries and drop table references outside the locks.
Keep the pending setup check before allocating a new session so abandoned InProgress sessions can release their slots even at the connection limit. Retain the timeout and reference checks and dispose of those sessions outside the locks. Leave ended Expired sessions to the expiration worker.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability addressed in this Linux kernel update pertains to the ksmbd server implementation, specifically concerning session lifecycle management during logoff and credential expiration events. In network file sharing protocols such as SMB2 and SMB3, maintaining proper state transitions for client sessions is critical for both security and resource stability. The identified flaw allowed ended or logged-off sessions to persist in an Expired state with zero credential expiry while retaining their memory allocations and connection slots if no subsequent setup requests arrived on the owning connection. This behavior represents a classic case of improper cleanup, where resources are not released promptly after a session terminates, leading to potential resource exhaustion and stale security contexts lingering within the system kernel space.
From a technical perspective, the core issue lies in how sessions were unpublished and removed from internal data structures during disconnection or expiration events. Previously, when a LOGOFF command was received or a previous session was replaced, the associated session object remained active enough to keep response signing and encryption keys alive due to lingering request references. Furthermore, the removal of procfs entries was not handled with sufficient atomicity relative to reference counting, creating race conditions where a reader could potentially remove its own entry on the last put operation before the system had fully finalized the teardown process. This lack of strict ordering in resource deallocation allowed sessions to retain their connection slots indefinitely under specific timing conditions, effectively bypassing intended limits and security boundaries.
The operational impact of this vulnerability includes increased memory consumption due to unreleased session structures and potential denial-of-service scenarios where an attacker could exhaust available connection slots by triggering repeated logoffs without proper cleanup. Additionally, retaining encryption keys for terminated sessions poses a significant risk as it may allow unauthorized access or decryption if those keys are compromised or reused improperly in subsequent interactions. The persistence of these stale entries also complicates audit trails and security monitoring, as the system state does not accurately reflect active versus inactive connections, thereby obscuring potential malicious activity that relies on session hijacking or replay attacks using old credentials.
To mitigate this vulnerability, the fix implements a rigorous reclamation process for ended sessions within the global table expiration worker. The updated logic ensures that only expired sessions with zero credential expiry and no outstanding references beyond the basic table reference are selected for cleanup, while intentionally preserving sessions whose Kerberos credentials have merely expired to allow for seamless reauthentication without full session teardown. Crucially, the fix unlinks the session from its setup connection and all associated channel connections, covering both primary SMB2 sessions and secondary SMB3 channels. By queuing these sessions on a separate disposal list outside of critical locks like conn_list_lock, the system prevents deadlocks while ensuring that hash nodes are properly removed before procfs entries are cleared. This approach eliminates double-removal risks and ensures that pending setup checks correctly release slots for abandoned InProgress sessions even when connection limits are reached, thereby restoring robust resource management and security posture to the ksmbd implementation.
This remediation aligns with industry standards such as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-756: Missing or Incorrectly Implemented Security Checkpoint, which describe failures in properly releasing resources and validating state transitions respectively. In terms of adversarial tactics, the vulnerability relates to ATT&CK technique T1078: Valid Accounts, as improper session management can allow attackers to maintain persistent access through stale sessions that were not correctly invalidated upon logout or expiration. By enforcing strict lifecycle controls and ensuring complete teardown of cryptographic contexts and connection slots, the update significantly reduces the attack surface for persistence mechanisms and resource exhaustion attacks targeting network file sharing services.