CVE-2026-52911
Analyzed
Analyzed - Analysis Complete
ksmbd Session Binding Information Disclosure in Linux Kernel
Vulnerability report for CVE-2026-52911, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-06-21
Last updated on: 2026-07-08
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: scope conn->binding slowpath to bound sessions only
When the binding SESSION_SETUP sets conn->binding = true, the flag stays
set after the call so that the global session lookup in
ksmbd_session_lookup_all() can find the session, which was not added to
conn->sessions. Because the flag is connection-wide, the global lookup
path will also resolve any other session by id if asked.
Tighten the global lookup so that the returned session must have this
connection registered in its channel xarray (sess->ksmbd_chann_list).
The channel entry is installed by the existing binding_session path in
ntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes
successfully, so this condition is a strict equivalent of "this
connection has been accepted as a channel of this session". Connections
that have not bound to a given session cannot reach it via the global
table.
The existing conn->binding gate for entering the slowpath is preserved
so that non-binding connections keep the fast-path-only behavior, and
the session->state check is unchanged.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.2 (inc) to 6.6.141 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.91 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.33 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.10 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.175 (exc) |
| linux | linux_kernel | From 5.15 (inc) to 5.15.209 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
