CVE-2026-90152

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix session leak in ksmbd_session_register()

See the procedure below:

smb2_sess_setup

ksmbd_smb2_session_create

__session_create

atomic_set(&sess->refcnt, 2)

hash_add(sessions_table, &sess->hlist, sess->id)

ksmbd_session_register

xa_store(&conn->sessions, sess->id, sess) // fail

ksmbd_user_session_put

atomic_dec(&sess->refcnt) // refcnt is 1, session is not freed

Remove the session from sessions_table and drop its table reference if

xa_store() fails.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References