CVE-2026-99279
Description
A flaw was found in the Linux kernel's ksmbd (Server Message Block) server. Expired sessions resulting from logoff or session replacement are not properly reclaimed when no further setup requests arrive on the connection. A remote attacker can exploit this flaw to retain allocated memory and connection slots, leading to resource exhaustion and a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate severity because exploitation requires an authenticated remote user to establish sessions, and the impact is confined to a denial of service caused by memory and connection exhaustion rather than code execution or data compromise. In standard Red Hat Enterprise Linux environments, the in-kernel SMB server (ksmbd) is not loaded or configured by default, as user-space Samba serves as the standard SMB implementation. Systems are only exposed to risk if the ksmbd kernel module has been explicitly enabled and made accessible over the network.
Mitigation
To mitigate this vulnerability, prevent the ksmbd kernel module from being loaded by adding a configuration file to /etc/modprobe.d:
# echo "install ksmbd /bin/false" > /etc/modprobe.d/ksmbd.conf
If the module is currently loaded in memory, unload it:
# modprobe -r ksmbd
If ksmbd is required for operations and cannot be disabled, restrict incoming network traffic to the SMB port (default TCP port 445) to trusted clients only using firewall rules.
Warning: Unloading the kernel module will immediately terminate all active SMB sessions and disrupt file-sharing services for connected clients. Reloading firewall rules or restarting network services may cause temporary connection interruptions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
