CVE-2026-52911
Received Received - Intake
ksmbd Session Binding Information Disclosure in Linux Kernel

Publication date: 2026-06-21

Last updated on: 2026-06-21

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope conn->binding slowpath to bound sessions only When the binding SESSION_SETUP sets conn->binding = true, the flag stays set after the call so that the global session lookup in ksmbd_session_lookup_all() can find the session, which was not added to conn->sessions. Because the flag is connection-wide, the global lookup path will also resolve any other session by id if asked. Tighten the global lookup so that the returned session must have this connection registered in its channel xarray (sess->ksmbd_chann_list). The channel entry is installed by the existing binding_session path in ntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes successfully, so this condition is a strict equivalent of "this connection has been accepted as a channel of this session". Connections that have not bound to a given session cannot reach it via the global table. The existing conn->binding gate for entering the slowpath is preserved so that non-binding connections keep the fast-path-only behavior, and the session->state check is unchanged.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-21
Last Modified
2026-06-21
Generated
2026-06-21
AI Q&A
2026-06-21
EPSS Evaluated
N/A
NVD
CVE-2026-52911
EUVD
EUVD-2026-38148
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel ksmbd *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's ksmbd component related to session binding. When a SESSION_SETUP sets the connection's binding flag to true, this flag remains set even though the session is not properly added to the connection's session list. Because the binding flag is connection-wide, a global session lookup can incorrectly find sessions that the connection is not actually bound to.

The fix tightens the global session lookup so that a session is only returned if the connection is registered in the session's channel list, ensuring that only connections properly accepted as channels of a session can access it. This prevents unauthorized access to sessions via the global lookup.

Impact Analysis

This vulnerability could allow a connection to access sessions it is not properly bound to, potentially leading to unauthorized access to session data or resources. This could compromise the security and integrity of the system by allowing unintended session interactions.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart