https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 05:42:48 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90154 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: scope session state changes to bound connections</p> <p>ksmbd_all_conn_set_status() treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move an unrelated connection to NEED_RECONNECT or NEED_SETUP.</p> <p>Pass the target session itself and select connections using either the connection-local session xarray or the session&#39;s permanent channel list. Use the same association test while waiting for requests to drain.</p> <p>Serialize session-wide status changes under request_lock and do not overwrite EXITING or RELEASING. Protect the shutdown transition with the same lock so a concurrent session update cannot revive a closing connection.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: scope session state changes to bound connections</p> <p>ksmbd_all_conn_set_status() treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move an unrelated connection to NEED_RECONNECT or NEED_SETUP.</p> <p>Pass the target session itself and select connections using either the connection-local session xarray or the session&#39;s permanent channel list. Use the same association test while waiting for requests to drain.</p> <p>Serialize session-wide status changes under request_lock and do not overwrite EXITING or RELEASING. Protect the shutdown transition with the same lock so a concurrent session update cannot revive a closing connection.</p> https://vulnerability.circl.lu/vuln/cve-2026-90154