Is CVE-2026-99278 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99278 being exploited in the wild.

How severe is CVE-2026-99278?

Informational severity, published 7 November 2026.

Which products and versions are affected?

Linux Kernel prior to fix commit 94f8462fc9d5332bc54e91605003c17381e9171a.

Is there a fix for CVE-2026-99278?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-99278 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-99278?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99278: Linux kernel ksmbd session limit resource exhaustion

CVE-2026-99278 · Severity: info · Published 2026-11-07

The Linux kernel's ksmbd SMB/CIFS server implementation did not properly limit the number of authentication sessions a client could create on a single connection. An attacker could repeatedly authenticate and exhaust server resources, potentially causing denial of service by preventing legitimate users from establishing new sessions.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-99278 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99278 being exploited in the wild.
How severe is CVE-2026-99278?: Informational severity, published 7 November 2026.
Which products and versions are affected?: Linux Kernel prior to fix commit 94f8462fc9d5332bc54e91605003c17381e9171a.
Is there a fix for CVE-2026-99278?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-99278 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-99278?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in ksmbd's session management where the pending setup limit only counted InProgress sessions, allowing an authenticated client to repeatedly complete authentication and accumulate an unbounded number of Valid sessions on one connection. The fix implements per-connection session slot reservation during session allocation and authentication, with a configurable limit defaulting to 64 sessions per connection, preventing resource exhaustion.

Affected products

Linux Linux kernel prior to fix commit 94f8462fc9d5332bc54e91605003c17381e9171a

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.