{"apiVersion":"1.0","identifier":"CVE-2026-99277","description":"In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.","publishedAt":"2026-11-07T14:17:03","lastModifiedAt":"2026-11-10T17:17:57","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99277","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00246,"riskScore":0.77,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99277","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99277","en":"https://www.redsauce.net/en/cves/CVE-2026-99277","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99277","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99277","de":"https://www.redsauce.net/de/cves/CVE-2026-99277","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99277","el":"https://www.redsauce.net/el/cves/CVE-2026-99277"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99277"}}