Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) could allow unauthorized access to user sessions. The ksmbd component provides file-sharing services over a network. Due to a flaw in how connections are tracked, an attacker could potentially interact with sessions they did not create, leading to unauthorized access to shared data or session hijacking.
Technical details
A vulnerability in ksmbd (the Linux kernel SMB server) arises from improper scoping of the 'conn->binding' flag during SMB3 multichannel SESSION_SETUP. When this flag is set, the global session lookup function ksmbd_session_lookup_all() uses a slowpath that can resolve any session by ID, even if that session is not associated with the current connection. This occurs because the flag remains set after the initial call, allowing subsequent requests on the same connection to potentially access other active sessions. The fix tightens the lookup by verifying that the connection is registered in the session's channel list (sess->ksmbd_chann_list) before returning the session object.
Affected products
- Linux Linux f5a544e3bab7 to e74c00c6af42, f5a544e3bab7 to e3a93ce6e257, f5a544e3bab7 to 1ff46c9915c1, f5a544e3bab7 to 974c1c224e85, f5a544e3bab7 to 2cc8a4db633b, f5a544e3bab7 to 1e2bec062c5c, f5a544e3bab7 to b0da97c034b6
Timeline
- 2026-06-21: disclosed
- 2026-06-21: advisory
References
- https://git.kernel.org/stable/c/1e2bec062c5c9ec282636715166056d0998d746d
- https://git.kernel.org/stable/c/1ff46c9915c1cbf454db58a8cb87f7cac818e6a6
- https://git.kernel.org/stable/c/2cc8a4db633b10715450b291c1343859a4b2c509
- https://git.kernel.org/stable/c/974c1c224e85549dc3459f3bb2255bbbdd2b9372
- https://git.kernel.org/stable/c/b0da97c034b6107d14e537e212d4ce8b22109a58
- https://git.kernel.org/stable/c/e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a
- https://git.kernel.org/stable/c/e74c00c6af428a39e564cdc5bd3a3648c6d8de87