CVE-2026-90154ksmbd: scope session state changes to bound connections
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbd_all_conn_set_status() treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move an unrelated connection to NEED_RECONNECT or NEED_SETUP. Pass the target session itself and select connections using either the connection-local session xarray or the session's permanent channel list. Use the same association test while waiting for requests to drain. Serialize session-wide status changes under request_lock and do not overwrite EXITING or RELEASING. Protect the shutdown transition with the same lock so a concurrent session update cannot revive a closing connection.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f5a544e3bab78142207e0242d22442db85ba1eff before 1ff0e41afbe73240a7d7b96d4e8e86d0aaf0fe0b; from f5a544e3bab78142207e0242d22442db85ba1eff before 0875872718b98e8530fbc634e5aa7dbd3253b80d; from f5a544e3bab78142207e0242d22442db85ba1eff before c50e628122aed077695669e25b842e778511a43d | CNA record |
References
- https://git.kernel.org/stable/c/1ff0e41afbe73240a7d7b96d4e8e86d0aaf0fe0b
- https://git.kernel.org/stable/c/0875872718b98e8530fbc634e5aa7dbd3253b80d
- https://git.kernel.org/stable/c/c50e628122aed077695669e25b842e778511a43d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.