CVE-2026-99277
📛 CVE Title
ksmbd: hold a connection reference for each session channel
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Linux
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
- —
- Reserved
- 2026-09-25
- Published
- 2026-11-07 14:08 UTC
- Last updated
- 2026-11-07 14:08 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99277.json
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119285
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Linux | Linux |
d7fd1f98607f2cd358e583f9548bdf0173090a86 (affected),
d7fd1f98607f2cd358e583f9548bdf0173090a86 (affected),
c99ea7855124ca1428a1e59c2b4590aaef34eacf (affected),
7.2.8 (affected)
|
— |
| Linux | Linux |
7.3 (affected),
0 (unaffected),
7.3.2 (unaffected),
7.4-rc1 (unaffected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:docs.netscaler.com
NetScaler detects CVEs and provides remediation suggestions the same. This topic lists the remediations suggested for the following CVEs :
2026-11-08 11:07 UTC -
web:labs.beazley.security
Citrix NetScaler Vulnerabilities Under Active Exploitation ( CVE - 2026 -88771, CVE - 2026 -88772, & CVE - 2026 -88779) Update October 4th 2026 : Citrix has confirmed that this vulnerability is a Denial of Service (DoS) vulnerability. Update October 2nd 2026 : Citrix released a security bulletin warning of another issue, this time in the SAML authentication subsystem. On September 26th, 2026 , security ...
2026-11-08 11:07 UTC -
web:pentestit.com
This post is my analysis of the Citrix NetScaler ADC and Gateway CVE - 2026 -88771 and CVE - 2026 -88772 vulnerabilities along with hunting and detection guidelines.
2026-11-08 11:07 UTC -
web:securityarsenal.com
CISA has confirmed active exploitation of two new Citrix NetScaler flaws ( CVE - 2026 -88771, CVE - 2026 -88772). Edge appliance operators must patch , hunt, and rotate credentials now.
2026-11-08 11:07 UTC -
web:thehackernews.com
Unknown attackers exploit a patched Citrix NetScaler flaw to gain root access and deploy web shells and a tunneler.
2026-11-08 11:07 UTC -
web:threatprotect.qualys.com
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered agencies to secure their systems against two critical Citrix NetScaler vulnerabilities that have been exploited in attacks. CISA added CVE - 2026 -88771 and CVE - 2026 -88772 to its Known Exploited Vulnerabilities Catalog. CISA urged users to patch the vulnerabilities before September 30, 2026 . CVE - 2026 -88771 This is an improper ...
2026-11-08 11:07 UTC -
web:windowsforum.com
CISA added two actively exploited NetScaler flaws to KEV; customer-managed ADC and Gateway appliances, including August-patched builds, need updates and compromise checks.
2026-11-08 11:07 UTC -
web:www.cyberkendra.com
Citrix on Sunday released patches for two critical NetScaler ADC and NetScaler Gateway vulnerabilities that attackers exploited as zero-days, one of which allows unauthenticated command execution on appliances running the default configuration. The flaws, tracked as CVE - 2026 -88771 and CVE - 2026 -88772 ...
2026-11-08 11:07 UTC -
web:www.esentire.com
THE THREAT As of September 29th, 2026 , eSentire has observed in-the-wild exploitation of CVE - 2026 -88771 and CVE - 2026 -88772, with identified attacks being traced back to early-September. CVE - 2026 -88771 (CVSS: 9.5) and CVE - 2026 -88772 (CVSS: 8.1) are critical vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway that can lead to unauthenticated Remote Code Execution (RCE). eSentire ...
2026-11-08 11:07 UTC -
web:www.nextron-systems.com
Over the last several days, our Research Team has continued to analyze artifacts associated with the exploitation of Citrix NetScaler CVE - 2026 -88771 and CVE - 2026 -88772. As more samples, technical reports and information from partners became available, we extended the initial THOR coverage with another set of dedicated detection rules. We now have 21 new rules covering different parts of the ...
2026-11-08 11:07 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-99277.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b333aed69cfc2c8687b86b6a4364a0dffc16dd8",
"status": "affected",
"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
"versionType": "git"
},
{
"lessThan": "add8d7fb04efe564193df73581889c62fc0016f1",
"status": "affected",
"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
"versionType": "git"
},
{
"status": "affected",
"version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf",
"versionType": "git"
},
{
"lessThan": "7.3",
"status": "affected",
"version": "7.2.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.3"
},
{
"lessThan": "7.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.4-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.2",
"versionStartIncluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4-rc1",
"versionStartIncluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.2.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: hold a connection reference for each session channel\n\nksmbd_session_unregister() removes a session from the global and per-\nconnection tables before dropping the table reference. A concurrent\nreference holder can keep the session and its channel list alive after\nthose removals.\n\nConnection cleanup can no longer find the unpublished session to remove its\nchannels. Since a channel only stores a raw conn pointer, the connection\ncan be freed while another session reference holder is still accessing it,\nfor example during SMB3.1.1 binding or a procfs read.\n\nTake a connection reference when registering a channel and release it on\ninsertion failure, channel removal, or final session destruction. Keep the\nchannels and signing keys until the session is destroyed so a response can\nstill be signed after the session has been unregistered."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T14:08:46.710Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b333aed69cfc2c8687b86b6a4364a0dffc16dd8"
},
{
"url": "https://git.kernel.org/stable/c/add8d7fb04efe564193df73581889c62fc0016f1"
}
],
"title": "ksmbd: hold a connection reference for each session channel",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99277",
"datePublished": "2026-11-07T14:08:46.710Z",
"dateReserved": "2026-09-25T10:25:14.405Z",
"dateUpdated": "2026-11-07T14:08:46.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}