HIGH Introduced in 7.3
ksmbd SessionChannel UAF
CVE-2026-99277
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.
02KernelScan AI Analysis
Risk summary
A use-after-free in the kernel SMB server (ksmbd) allows a remote unauthenticated attacker to corrupt kernel memory by racing session unregistration against connection cleanup. Successful exploitation can lead to arbitrary code execution in kernel context, full system compromise, or denial of service.
Vulnerability analysis
The ksmbd kernel SMB server tracks sessions and their per-connection channels. When a session is unregistered, it is removed from lookup tables before the last reference is dropped, but a concurrent holder can keep the session and its channel list alive. Connection cleanup then fails to find the unpublished session to remove its channels, and because each channel only stored a raw pointer to its connection, the connection could be freed while another thread still accessed it — for example during SMB3.1.1 session binding or a procfs read. The fix makes channel registration take a reference on the connection (ksmbd_conn_get) and releases it on insertion failure, explicit channel removal, or final session teardown, ensuring the connection stays alive as long as any channel references it. The bug is reachable over the network by any SMB client that can open a TCP connection to the ksmbd listener (port 445); no authentication or local privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.2.8 | 7.3 | 4b333aed69cf |
| 7.3 | 7.3 | 7.3.2 | add8d7fb04ef |
| mainline | 7.3 | 7.4-rc1 | — |