SB2026110841 - Allocation of Resources Without Limits or Throttling in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-99278)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to exhaust system resources and cause a denial of service.

The vulnerability exists due to resource allocation without effective limits in the Linux kernel ksmbd session management component when handling session setup requests, because the pending setup limit counts only in-progress sessions and excludes successfully authenticated sessions. A remote user can repeatedly complete authentication and retain an unbounded number of valid sessions on a single connection to exhaust system resources and cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/94f8462fc9d5332bc54e91605003c17381e9171a
• https://git.kernel.org/stable/c/dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68