Answer in brief
CVE-2026-99277 records a Unknown severity vulnerability in ksmbd: hold a connection reference for each session channel. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d7fd1f98607f2cd358e583f9548bdf0173090a86 <4b333aed69cfc2c8687b86b6a4364a0dffc16dd8 || >=d7fd1f98607f2cd358e583f9548bdf0173090a86 <add8d7fb04efe564193df73581889c62fc0016f1 || c99ea7855124ca1428a1e59c2b4590aaef34eacf || >=7.2.8 <7.3 | 4b333aed69cfc2c8687b86b6a4364a0dffc16dd8, add8d7fb04efe564193df73581889c62fc0016f1, 7.3 |
| Linux/Linuxgeneric | 7.3 | Not reported |
Published upstream
Nov 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 7, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.
Quoted source text, attributed separately from HOL analysis.