In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix session leak in ksmbd_session_register()

See the procedure below:

smb2_sess_setup
ksmbd_smb2_session_create
__session_create
atomic_set(&sess->refcnt, 2)
hash_add(sessions_table, &sess->hlist, sess->id)
ksmbd_session_register
xa_store(&conn->sessions, sess->id, sess) // fail
ksmbd_user_session_put
atomic_dec(&sess->refcnt) // refcnt is 1, session is not freed

Remove the session from sessions_table and drop its table reference if
xa_store() fails.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f5c779b7ddbda30866cf2a27c63e34158f858c73 affected < 03a22a003f41b182245e6c71fe565e277cff7094
f5c779b7ddbda30866cf2a27c63e34158f858c73 affected < b967a595fb735d313a8676b2ca6a4cba38506482
f5c779b7ddbda30866cf2a27c63e34158f858c73 affected < 55c677619084f9c9fa4146d933cc8ccafc924c87
f5c779b7ddbda30866cf2a27c63e34158f858c73 affected < 99b25b046e47e4904373cfeb445c5483f1633d88
708c304b583d789957399dd8237f212cf8ad1e4d affected —
f623f627ad2b1dc215ab3b0df53fb05cfd3a1c3b affected —
d270631c21e68fb8016d6e231d022d7023a2df6f affected —
02f41d88f15d6b7d523e52cc3f87488f57e9265b affected —
5.15.145 affected < 5.16
6.1.29 affected < 6.2
6.2.16 affected < 6.3
6.3.2 affected < 6.4
Linux Linux affected
Version Status Constraints
6.4 affected —
0 unaffected < 6.4
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/03a22a003f41b182245e6c71fe565e277cff7094 cve-icon cve-icon
https://git.kernel.org/stable/c/55c677619084f9c9fa4146d933cc8ccafc924c87 cve-icon cve-icon
https://git.kernel.org/stable/c/99b25b046e47e4904373cfeb445c5483f1633d88 cve-icon cve-icon
https://git.kernel.org/stable/c/b967a595fb735d313a8676b2ca6a4cba38506482 cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb/server: fix session leak in ksmbd_session_register() See the procedure below: smb2_sess_setup ksmbd_smb2_session_create __session_create atomic_set(&sess->refcnt, 2) hash_add(sessions_table, &sess->hlist, sess->id) ksmbd_session_register xa_store(&conn->sessions, sess->id, sess) // fail ksmbd_user_session_put atomic_dec(&sess->refcnt) // refcnt is 1, session is not freed Remove the session from sessions_table and drop its table reference if xa_store() fails.
Title smb/server: fix session leak in ksmbd_session_register()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:06:45.641Z

Reserved: 2026-09-11T19:38:34.789Z

Link: CVE-2026-90152

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:08.207

Modified: 2026-09-17T17:17:08.207

Link: CVE-2026-90152

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.