CVE-2026-99280
📛 CVE Title
ksmbd: drain session procfs readers before dropping table references
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the last remaining reference, its final put calls proc_remove() from its own callback and waits for that callback to finish. Remove the procfs entry before dropping the table reference in the registration failure path. Queue sessions removed during connection cleanup and drain their procfs readers after releasing both session locks, then return their table references. Keep the global hash node unhashed while a session is queued so a concurrent unregister cannot drop the reference again. Previous-session replacement also destroys the file table before the session is finally freed. Detach the idr under the lock used by procfs file counters, and report zero files after it has been detached. This prevents a reader from accessing the idr during or after its destruction.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Linux
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
- —
- Reserved
- 2026-09-25
- Published
- 2026-11-07 14:08 UTC
- Last updated
- 2026-11-07 14:08 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99280.json
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119282
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Linux | Linux |
d7fd1f98607f2cd358e583f9548bdf0173090a86 (affected),
d7fd1f98607f2cd358e583f9548bdf0173090a86 (affected),
c99ea7855124ca1428a1e59c2b4590aaef34eacf (affected),
7.2.8 (affected)
|
— |
| Linux | Linux |
7.3 (affected),
0 (unaffected),
7.3.2 (unaffected),
7.4-rc1 (unaffected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:access.redhat.com
Overall, you have the following options: Upgrade to a supported product version that includes a fix for this vulnerability (recommended). Apply a mitigation (if one exists). Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.
2026-11-08 11:06 UTC -
web:access.redhat.com
Products & tools Red Hat Documentation Find answers, get guidance, and learn how to use Red Hat products. Red Hat Ecosystem Catalog Find hardware, software, and cloud providers―and download container images―certified to perform with Red Hat technologies.
2026-11-08 11:06 UTC -
web:app.opencve.io
Remediation No solution or workaround provided in the CVE record. OpenCVE Recommended Actions Upgrade Google Chrome to version 148..7778.216 or later to remove the ANGLE bug and eliminate the out-of-bounds read.
2026-11-08 11:06 UTC -
web:cvedatabase.com
Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.
2026-11-08 11:06 UTC -
web:cybersecuritynews.com
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 26-04, titled "Prioritizing Security Updates Based on Risk," compelling all Federal Civilian Executive Branch (FCEB) agencies to remediate the most dangerous known exploited vulnerabilities within just three calendar days.
2026-11-08 11:06 UTC -
web:cyberupdates365.com
Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.
2026-11-08 11:06 UTC -
web:learn.microsoft.com
In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort ...
2026-11-08 11:06 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-11-08 11:06 UTC -
web:support.sap.com
On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.
2026-11-08 11:06 UTC -
web:www.suse.com
Secure your Linux systems from CVE - 2026 -9928. Stay ahead of potential threats with the latest security updates from SUSE.
2026-11-08 11:06 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-99280.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/vfs_cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6789f0983f8e85ce3a5ed8c50fc05d613ead9c2c",
"status": "affected",
"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
"versionType": "git"
},
{
"lessThan": "1c087cf7d5386c708d8984b263280b42b3daada0",
"status": "affected",
"version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
"versionType": "git"
},
{
"status": "affected",
"version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf",
"versionType": "git"
},
{
"lessThan": "7.3",
"status": "affected",
"version": "7.2.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/vfs_cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.3"
},
{
"lessThan": "7.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.4-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.2",
"versionStartIncluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4-rc1",
"versionStartIncluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.2.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: drain session procfs readers before dropping table references\n\nSession registration failure and connection cleanup can drop the table\nreference while the per-session procfs entry is still accessible. If a\nreader holds the last remaining reference, its final put calls\nproc_remove() from its own callback and waits for that callback to\nfinish.\n\nRemove the procfs entry before dropping the table reference in the\nregistration failure path. Queue sessions removed during connection\ncleanup and drain their procfs readers after releasing both session\nlocks, then return their table references. Keep the global hash node\nunhashed while a session is queued so a concurrent unregister cannot\ndrop the reference again.\n\nPrevious-session replacement also destroys the file table before the\nsession is finally freed. Detach the idr under the lock used by procfs\nfile counters, and report zero files after it has been detached. This\nprevents a reader from accessing the idr during or after its\ndestruction."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T14:08:47.488Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6789f0983f8e85ce3a5ed8c50fc05d613ead9c2c"
},
{
"url": "https://git.kernel.org/stable/c/1c087cf7d5386c708d8984b263280b42b3daada0"
}
],
"title": "ksmbd: drain session procfs readers before dropping table references",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99280",
"datePublished": "2026-11-07T14:08:47.488Z",
"dateReserved": "2026-09-25T10:25:14.405Z",
"dateUpdated": "2026-11-07T14:08:47.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}