The Linux kernel project has published fixes for a cluster of flaws in ksmbd, the in-kernel server that lets Linux machines share files with Windows systems using the SMB protocol. Six related vulnerabilities, tracked as CVE-2026-99273 and CVE-2026-99276 through CVE-2026-99280, were published on 7 November 2026.

The most serious of the three described in detail so far is CVE-2026-99277, a use-after-free flaw in how ksmbd tracks session channels. A connection could be freed while another session reference was still using it, risking instability during SMB3.1.1 binding or when reading session data. CVE-2026-99276 can deadlock the server when connection cleanup waits on session locks already held by another task, while CVE-2026-99273 is a buffer overflow: the code writes a terminating unit after converted characters without reserving space for it, overflowing the response buffer by two bytes.

None of the flaws has a CVSS score from the National Vulnerability Database yet, and none is known to have been exploited. Fixes are in Linux kernel 7.3 and in the stable-tree commits, so administrators running ksmbd should apply their distribution's kernel update. The use-after-free flaw affects kernels from 7.2.8 up to 7.3, and the other entries in the batch have their own ranges. Systems that do not run ksmbd are not affected.

[Source: cve.now](https://cve.now/CVE-2026-99277) | [Source: radar.offseq.com](https://radar.offseq.com/threat/cve-2026-99277-ksmbd-hold-a-connection-reference-for-each-session-channel-in-linux-kernel-f987ede8d4d5d15a)