CVE-2026-90152smb/server: fix session leak in ksmbd_session_register()
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix session leak in ksmbd_session_register() See the procedure below: smb2_sess_setup ksmbd_smb2_session_create __session_create atomic_set(&sess->refcnt, 2) hash_add(sessions_table, &sess->hlist, sess->id) ksmbd_session_register xa_store(&conn->sessions, sess->id, sess) // fail ksmbd_user_session_put atomic_dec(&sess->refcnt) // refcnt is 1, session is not freed Remove the session from sessions_table and drop its table reference if xa_store() fails.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 43 days later
· 43 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected f623f627ad2b1dc215ab3b0df53fb05cfd3a1c3b – < 869807cdd5599c289c21d40f36a504d72a0d23c6
- affected f5c779b7ddbda30866cf2a27c63e34158f858c73 – < 988f99bfddda4e2d1da5f6e98b237dd85e123cee
- affected f5c779b7ddbda30866cf2a27c63e34158f858c73 – < 03a22a003f41b182245e6c71fe565e277cff7094
- affected f5c779b7ddbda30866cf2a27c63e34158f858c73 – < b967a595fb735d313a8676b2ca6a4cba38506482
- affected f5c779b7ddbda30866cf2a27c63e34158f858c73 – < 55c677619084f9c9fa4146d933cc8ccafc924c87
- affected f5c779b7ddbda30866cf2a27c63e34158f858c73 – < 99b25b046e47e4904373cfeb445c5483f1633d88
- affected 708c304b583d789957399dd8237f212cf8ad1e4d
- affected d270631c21e68fb8016d6e231d022d7023a2df6f
- affected 02f41d88f15d6b7d523e52cc3f87488f57e9265b
- affected 6.1.29 – < 6.1.191
- affected 5.15.145 – < 5.16
- affected 6.2.16 – < 6.3
- affected 6.3.2 – < 6.4
- affected 6.4
- unaffected < 6.4
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/869807cdd5599c289c21d40f36a504d72a0d23c6 (opens in a new tab)
- https://git.kernel.org/stable/c/988f99bfddda4e2d1da5f6e98b237dd85e123cee (opens in a new tab)
- https://git.kernel.org/stable/c/03a22a003f41b182245e6c71fe565e277cff7094 (opens in a new tab)
- https://git.kernel.org/stable/c/b967a595fb735d313a8676b2ca6a4cba38506482 (opens in a new tab)
- https://git.kernel.org/stable/c/55c677619084f9c9fa4146d933cc8ccafc924c87 (opens in a new tab)
- https://git.kernel.org/stable/c/99b25b046e47e4904373cfeb445c5483f1633d88 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-81745 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-90152)Record last updated .