CVE-2026-99278
📛 CVE Title
ksmbd: limit sessions on each connection
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a connection slot before allocating a session and retain a connection reference while authentication is in progress. The first SMB3 channel takes over that reservation; binding to another connection reserves one slot there. Reauthentication and authentication continuation reuse the existing reservation. Return slots on allocation or insertion failure, channel removal, and final session destruction. Accept max_sessions_per_connection in reserved startup-request space and default to 64 when older tools leave it zero. Keep the request size and existing field offsets unchanged. Expose the configured limit in procfs. The existing connection limits bound the aggregate number of sessions without a separate global session allocation limit.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Linux
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
- —
- Reserved
- 2026-09-25
- Published
- 2026-11-07 14:08 UTC
- Last updated
- 2026-11-07 14:08 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99278.json
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119284
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Linux | Linux |
d7fd1f98607f2cd358e583f9548bdf0173090a86 (affected),
d7fd1f98607f2cd358e583f9548bdf0173090a86 (affected),
c99ea7855124ca1428a1e59c2b4590aaef34eacf (affected),
7.2.8 (affected)
|
— |
| Linux | Linux |
7.3 (affected),
0 (unaffected),
7.3.2 (unaffected),
7.4-rc1 (unaffected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:access.redhat.com
Overall, you have the following options: Upgrade to a supported product version that includes a fix for this vulnerability (recommended). Apply a mitigation (if one exists). Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.
2026-11-08 11:06 UTC -
web:access.redhat.com
Products & tools Red Hat Documentation Find answers, get guidance, and learn how to use Red Hat products. Red Hat Ecosystem Catalog Find hardware, software, and cloud providers―and download container images―certified to perform with Red Hat technologies.
2026-11-08 11:06 UTC -
web:blog.qualys.com
Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services.
2026-11-08 11:06 UTC -
web:cvedatabase.com
Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.
2026-11-08 11:06 UTC -
web:forum.proxmox.com
After the news of a possible KVM escape made the rounds at the start of the month, we finally got some more information and a patch to fix it...
2026-11-08 11:06 UTC -
web:sec.cloudapps.cisco.com
On October 7, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate the vulnerabilities that were disclosed on October 7, 2026 , Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability ...
2026-11-08 11:06 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-11-08 11:06 UTC -
web:support.sap.com
On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.
2026-11-08 11:06 UTC -
web:www.action1.com
This CISO-focused summary highlights the vulnerabilities and critical infrastructure risks that should take priority for remediation following Microsoft's September 2026 Patch Tuesday release.
2026-11-08 11:06 UTC -
web:www.oracle.com
Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.
2026-11-08 11:06 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-99278.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/connection.c",
"fs/smb/server/connection.h",
"fs/smb/server/ksmbd_netlink.h",
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/mgmt/user_session.h",
"fs/smb/server/proc.c",
"fs/smb/server/server.c",
"fs/smb/server/server.h",
"fs/smb/server/smb2pdu.c",
"fs/smb/server/transport_ipc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94f8462fc9d5332bc54e91605003c17381e9171a",
"status": "affected",
"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
"versionType": "git"
},
{
"lessThan": "dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68",
"status": "affected",
"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
"versionType": "git"
},
{
"status": "affected",
"version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf",
"versionType": "git"
},
{
"lessThan": "7.3",
"status": "affected",
"version": "7.2.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/connection.c",
"fs/smb/server/connection.h",
"fs/smb/server/ksmbd_netlink.h",
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/mgmt/user_session.h",
"fs/smb/server/proc.c",
"fs/smb/server/server.c",
"fs/smb/server/server.h",
"fs/smb/server/smb2pdu.c",
"fs/smb/server/transport_ipc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.3"
},
{
"lessThan": "7.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.4-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.2",
"versionStartIncluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4-rc1",
"versionStartIncluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.2.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: limit sessions on each connection\n\nThe pending setup limit only counts InProgress sessions. A client can\ncomplete authentication repeatedly and retain an unbounded number of Valid\nsessions on one connection.\n\nReserve a connection slot before allocating a session and retain a\nconnection reference while authentication is in progress. The first SMB3\nchannel takes over that reservation; binding to another connection reserves\none slot there. Reauthentication and authentication continuation reuse the\nexisting reservation. Return slots on allocation or insertion failure,\nchannel removal, and final session destruction.\n\nAccept max_sessions_per_connection in reserved startup-request space and\ndefault to 64 when older tools leave it zero. Keep the request size and\nexisting field offsets unchanged. Expose the configured limit in procfs.\nThe existing connection limits bound the aggregate number of sessions\nwithout a separate global session allocation limit."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T14:08:46.983Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94f8462fc9d5332bc54e91605003c17381e9171a"
},
{
"url": "https://git.kernel.org/stable/c/dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68"
}
],
"title": "ksmbd: limit sessions on each connection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99278",
"datePublished": "2026-11-07T14:08:46.983Z",
"dateReserved": "2026-09-25T10:25:14.405Z",
"dateUpdated": "2026-11-07T14:08:46.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}