CVE-2026-90154 ksmbd: scope session state changes to bound connections
A race condition in the Linux kernel ksmbd module allows attackers to disrupt SMB sessions, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90154?
CVE-2026-90154 is a vulnerability in Linux, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: scope session state changes to bound connections
ksmbd_all_conn_set_status() treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move an unrelated connection to NEED_RECONNECT or NEED_SETUP.
Pass the target session itself and select connections using either the connection-local session xarray or the session's permanent channel list. Use the same association test while waiting for requests to drain.
Serialize session-wide status changes under request_lock and do not overwrite EXITING or RELEASING. Protect the shutdown transition with the same lock so a concurrent session update cannot revive a closing connection.
Which versions are affected by CVE-2026-90154?
How do I fix CVE-2026-90154?
Apply the vendor's patch.
Is CVE-2026-90154 being exploited?
There is no known exploitation of CVE-2026-90154 in the wild and no public exploit code.
Sources
Also known as AZL-102420, BELL-CVE-2026-90154, DEBIAN-CVE-2026-90154, GHSA-c8qh-mfc7-v6c7, UBUNTU-CVE-2026-90154.