Deadlock in Linux kernel - CVE-2026-99276
Published: November 8, 2026
Vulnerability identifier: #VU161907
CSH Severity: Medium
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99276
CWE-ID: CWE-833
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service in the Linux kernel SMB server (ksmbd).
The vulnerability exists due to inconsistent lock ordering in ksmbd session management when connection expiration checks overlap with session teardown and a writer is queued on conn_list_lock. A remote user can trigger overlapping session operations that may deadlock the expiration worker and session teardown to cause a denial of service.
Affected software
Linux kernel
How to mitigate CVE-2026-99276
Install security update from vendor's repository.