CVE-2026-52911

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: scope conn->binding slowpath to bound sessions only

When the binding SESSION_SETUP sets conn->binding = true, the flag stays

set after the call so that the global session lookup in

ksmbd_session_lookup_all() can find the session, which was not added to

conn->sessions. Because the flag is connection-wide, the global lookup

path will also resolve any other session by id if asked.

Tighten the global lookup so that the returned session must have this

connection registered in its channel xarray (sess->ksmbd_chann_list).

The channel entry is installed by the existing binding_session path in

ntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes

successfully, so this condition is a strict equivalent of "this

connection has been accepted as a channel of this session". Connections

that have not bound to a given session cannot reach it via the global

table.

The existing conn->binding gate for entering

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References