HIGH Introduced in 5.15
ksmbd ConnStatus Race
CVE-2026-90154
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbd_all_conn_set_status() treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move an unrelated connection to NEED_RECONNECT or NEED_SETUP. Pass the target session itself and select connections using either the connection-local session xarray or the session's permanent channel list. Use the same association test while waiting for requests to drain. Serialize session-wide status changes under request_lock and do not overwrite EXITING or RELEASING. Protect the shutdown transition with the same lock so a concurrent session update cannot revive a closing connection.
02KernelScan AI Analysis
Risk summary
A network attacker can exploit a race condition in the ksmbd in-kernel SMB server's multichannel session management to corrupt connection state and potentially trigger use-after-free by reviving connections that are being shut down. The bug is reachable by an authenticated SMB client when multichannel support is enabled. Impact ranges from denial of service through connection disruption to potential kernel memory corruption.
Vulnerability analysis
When an SMB session ends or is replaced, the server updates the state of all connections it thinks belong to that session. The server used a temporary flag to decide which connections to update, which could catch unrelated connections and disrupt their state. Worse, these updates happened without proper locking, so a session change running at the same time as a connection teardown could overwrite a closing connection's state and bring it back to life while its resources were still being torn down, creating a use-after-free risk. The corrected code checks the actual session-to-connection bindings instead of the loose flag, and wraps all state changes in proper synchronization so a closing connection cannot be revived by a concurrent update. Any authenticated remote user with an active SMB session to a ksmbd server that has SMB3 multichannel enabled can trigger the affected paths.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 5.15 | 7.2.6 | 0875872718b9 |
| mainline | 5.15 | 7.3-rc1 | c50e628122ae |