-

CVE-2026-90152

smb/server: fix session leak in ksmbd_session_register()

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix session leak in ksmbd_session_register()

See the procedure below:

  smb2_sess_setup
    ksmbd_smb2_session_create
      __session_create
        atomic_set(&sess->refcnt, 2)
        hash_add(sessions_table, &sess->hlist, sess->id)
    ksmbd_session_register
      xa_store(&conn->sessions, sess->id, sess) // fail
    ksmbd_user_session_put
      atomic_dec(&sess->refcnt) // refcnt is 1, session is not freed

Remove the session from sessions_table and drop its table reference if
xa_store() fails.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version f5c779b7ddbda30866cf2a27c63e34158f858c73
Version < 03a22a003f41b182245e6c71fe565e277cff7094
Status affected
Version f5c779b7ddbda30866cf2a27c63e34158f858c73
Version < b967a595fb735d313a8676b2ca6a4cba38506482
Status affected
Version f5c779b7ddbda30866cf2a27c63e34158f858c73
Version < 55c677619084f9c9fa4146d933cc8ccafc924c87
Status affected
Version f5c779b7ddbda30866cf2a27c63e34158f858c73
Version < 99b25b046e47e4904373cfeb445c5483f1633d88
Status affected
Version 708c304b583d789957399dd8237f212cf8ad1e4d
Status affected
Version f623f627ad2b1dc215ab3b0df53fb05cfd3a1c3b
Status affected
Version d270631c21e68fb8016d6e231d022d7023a2df6f
Status affected
Version 02f41d88f15d6b7d523e52cc3f87488f57e9265b
Status affected
Version 5.15.145
Version < 5.16
Status affected
Version 6.1.29
Version < 6.2
Status affected
Version 6.2.16
Version < 6.3
Status affected
Version 6.3.2
Version < 6.4
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.4
Status affected
Version 0
Version < 6.4
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.52
Status unaffected
Version <= 7.2.*
Version 7.2.6
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.102
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/03a22a003f41b182245e6c71fe565e277cff7094
https://git.kernel.org/stable/c/b967a595fb735d313a8676b2ca6a4cba38506482
https://git.kernel.org/stable/c/55c677619084f9c9fa4146d933cc8ccafc924c87
https://git.kernel.org/stable/c/99b25b046e47e4904373cfeb445c5483f1633d88