---
id: CVE-2026-90154
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: scope session state changes to bound connections

  ksmbd_all_conn_set_status() treats every connection whose transient
  binding flag is set as belonging to the tar…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: scope session state changes to bound connections

  ksmbd_all_conn_set_status() treats every connection whose transient
  binding flag is set as belonging to the tar…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f5a544e3bab78142207e0242d22442db85ba1eff <
    0875872718b98e8530fbc634e5aa7dbd3253b80d
  - >-
    Linux >= f5a544e3bab78142207e0242d22442db85ba1eff <
    c50e628122aed077695669e25b842e778511a43d
  - Linux 5.15
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:08.500'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90154'
references:
  - url: 'https://git.kernel.org/stable/c/0875872718b98e8530fbc634e5aa7dbd3253b80d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c50e628122aed077695669e25b842e778511a43d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.874Z'
epss: 0.00198
epssPercentile: 0.08535
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: scope session state changes to bound connections

ksmbd_all_conn_set_status() treats every connection whose transient
binding flag is set as belonging to the target SessionId.  A logoff or
session replacement can consequently move an unrelated connection to
NEED_RECONNECT or NEED_SETUP.

Pass the target session itself and select connections using either the
connection-local session xarray or the session's permanent channel list.
Use the same association test while waiting for requests to drain.

Serialize session-wide status changes under request_lock and do not
overwrite EXITING or RELEASING. Protect the shutdown transition with the
same lock so a concurrent session update cannot revive a closing
connection.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.