CVE-2026-52911
ksmbd: scope conn->binding slowpath to bound sessions only
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope conn->binding slowpath to bound sessions only When the binding SESSION_SETUP sets conn->binding = true, the flag stays set after the call so that the global session lookup in ksmbd_session_lookup_all() can find the session, which was not added to conn->sessions. Because the flag is connection-wide, the global lookup path will also resolve any other session by id if asked. Tighten the global lookup so that the returned session must have this connection registered in its channel xarray (sess->ksmbd_chann_list). The channel entry is installed by the existing binding_session path in ntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes successfully, so this condition is a strict equivalent of "this connection has been accepted as a channel of this session". Connections that have not bound to a given session cannot reach it via the global table. The existing conn->binding gate for entering the slowpath is preserved so that non-binding connections keep the fast-path-only behavior, and the session->state check is unchanged.
INFO
Published Date :
June 21, 2026, 8:16 a.m.
Last Modified :
July 8, 2026, 3:13 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Verify session binding logic for security.
- Tighten global lookup to check channel xarray.
- Ensure non-binding connections use fast-path.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-52911.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-52911 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-52911
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-52911 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-52911 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15 up to (excluding) 5.15.209 Added Reference Type kernel.org: https://git.kernel.org/stable/c/1e2bec062c5c9ec282636715166056d0998d746d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/1ff46c9915c1cbf454db58a8cb87f7cac818e6a6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2cc8a4db633b10715450b291c1343859a4b2c509 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/974c1c224e85549dc3459f3bb2255bbbdd2b9372 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b0da97c034b6107d14e537e212d4ce8b22109a58 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e74c00c6af428a39e564cdc5bd3a3648c6d8de87 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 21, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f5a544e3bab78142207e0242d22442db85ba1eff', 'lessThan': 'e74c00c6af428a39e564cdc5bd3a3648c6d8de87', 'versionType': 'git'}, {'status': 'affected', 'version': 'f5a544e3bab78142207e0242d22442db85ba1eff', 'lessThan': 'e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a', 'versionType': 'git'}, {'status': 'affected', 'version': 'f5a544e3bab78142207e0242d22442db85ba1eff', 'lessThan': '1ff46c9915c1cbf454db58a8cb87f7cac818e6a6', 'versionType': 'git'}, {'status': 'affected', 'version': 'f5a544e3bab78142207e0242d22442db85ba1eff', 'lessThan': '974c1c224e85549dc3459f3bb2255bbbdd2b9372', 'versionType': 'git'}, {'status': 'affected', 'version': 'f5a544e3bab78142207e0242d22442db85ba1eff', 'lessThan': '2cc8a4db633b10715450b291c1343859a4b2c509', 'versionType': 'git'}, {'status': 'affected', 'version': 'f5a544e3bab78142207e0242d22442db85ba1eff', 'lessThan': '1e2bec062c5c9ec282636715166056d0998d746d', 'versionType': 'git'}, {'status': 'affected', 'version': 'f5a544e3bab78142207e0242d22442db85ba1eff', 'lessThan': 'b0da97c034b6107d14e537e212d4ce8b22109a58', 'versionType': 'git'}], 'programFiles': ['fs/smb/server/mgmt/user_session.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/mgmt/user_session.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope conn->binding slowpath to bound sessions only When the binding SESSION_SETUP sets conn->binding = true, the flag stays set after the call so that the global session lookup in ksmbd_session_lookup_all() can find the session, which was not added to conn->sessions. Because the flag is connection-wide, the global lookup path will also resolve any other session by id if asked. Tighten the global lookup so that the returned session must have this connection registered in its channel xarray (sess->ksmbd_chann_list). The channel entry is installed by the existing binding_session path in ntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes successfully, so this condition is a strict equivalent of "this connection has been accepted as a channel of this session". Connections that have not bound to a given session cannot reach it via the global table. The existing conn->binding gate for entering the slowpath is preserved so that non-binding connections keep the fast-path-only behavior, and the session->state check is unchanged. Added Reference https://git.kernel.org/stable/c/1e2bec062c5c9ec282636715166056d0998d746d Added Reference https://git.kernel.org/stable/c/1ff46c9915c1cbf454db58a8cb87f7cac818e6a6 Added Reference https://git.kernel.org/stable/c/2cc8a4db633b10715450b291c1343859a4b2c509 Added Reference https://git.kernel.org/stable/c/974c1c224e85549dc3459f3bb2255bbbdd2b9372 Added Reference https://git.kernel.org/stable/c/b0da97c034b6107d14e537e212d4ce8b22109a58 Added Reference https://git.kernel.org/stable/c/e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a Added Reference https://git.kernel.org/stable/c/e74c00c6af428a39e564cdc5bd3a3648c6d8de87