SB2026110850 - Missing Release of Resource after Effective Lifetime in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-99279)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service by exhausting memory and connection slots.

The vulnerability exists due to failure to release ended session resources in the Linux kernel ksmbd session management component when handling logoff and previous-session replacement. A remote user can establish and end sessions without sending further session setup requests on the owning connections, leaving expired sessions allocated to exhaust server resources.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1767a5e45dbf6a3b12105196dda4fb0ef80b9698
• https://git.kernel.org/stable/c/26534ef335e92b028eb58e44d98d46a0e26af0ec