CVE-2026-90154
kernel: ksmbd: scope session state changes to bound connections
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 13, 2026
Description
A flaw was found in ksmbd, a server message block (SMB) protocol implementation within the Linux kernel. This vulnerability arises from improper management of session state changes, which can cause the system to incorrectly associate active network connections with an unintended session. As a result, an attacker could potentially disrupt legitimate network connections, leading to a denial of service (DoS) for affected users.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-488 · Exposure of Data Element to Wrong Session