# CVE-2026-52911: ksmbd: scope conn->binding slowpath to bound sessions only

> An attacker can access unauthorized SMB sessions by exploiting a flaw in the ksmbd connection binding logic, allowing data access or modification.

- **Severity:** High 8.8 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 21 Jun 2026
- **Updated:** 5 Aug 2026
- **Also known as:** BELL-CVE-2026-52911, DEBIAN-CVE-2026-52911, GHSA-593m-gq54-r4vq, ROOT-OS-DEBIAN-12-CVE-2026-52911, ROOT-OS-UBUNTU-2204-CVE-2026-52911, ROOT-OS-UBUNTU-2404-CVE-2026-52911, UBUNTU-CVE-2026-52911

## What is CVE-2026-52911?

CVE-2026-52911 is a high-severity missing authorization vulnerability in Linux kernel, published on 21 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: scope conn->binding slowpath to bound sessions only

When the binding SESSION_SETUP sets conn->binding = true, the flag stays
set after the call so that the global session lookup in
ksmbd_session_lookup_all() can find the session, which was not added to
conn->sessions. Because the flag is connection-wide, the global lookup
path will also resolve any other session by id if asked.

Tighten the global lookup so that the returned session must have this
connection registered in its channel xarray (sess->ksmbd_chann_list).
The channel entry is installed by the existing binding_session path in
ntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes
successfully, so this condition is a strict equivalent of "this
connection has been accepted as a channel of this session". Connections
that have not bound to a given session cannot reach it via the global
table.

The existing conn->binding gate for entering the slowpath is preserved
so that non-binding connections keep the fast-path-only behavior, and
the session->state check is unchanged.

## Which versions are affected by CVE-2026-52911?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2026-52911?

Apply the vendor's patch.

## Is CVE-2026-52911 being exploited?

There is no known exploitation of CVE-2026-52911 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-52911 and fix it if it is affected.

What it is: CVE-2026-52911 is a high-severity missing authorization vulnerability in Linux kernel, published on 21 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-52911 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-52911/ (Markdown: https://insights.sbomify.com/CVE-2026-52911/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-52911
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52911
- OSV: https://osv.dev/vulnerability/CVE-2026-52911

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-52911/
Summaries are generated and may contain mistakes; the official description above is the record.