PT-2026-51201 · Linux · Linux

Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-52911

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the ksmbd module, a flaw exists where the conn->binding flag remains set after a SESSION SETUP call. Because this flag is connection-wide, the global session lookup function ksmbd session lookup all() can resolve any session by ID, even if the session was not added to conn->sessions. This allows connections that have not bound to a specific session to potentially reach it via the global table.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-52911

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-52911 · Security Note
• https://git.kernel.org/stable/c/2cc8a4db633b10715450b291c1343859a4b2c509 · Note
• https://twitter.com/VulmonFeeds/status/2068613523232411934 · Twitter Post
• https://git.kernel.org/stable/c/974c1c224e85549dc3459f3bb2255bbbdd2b9372 · Note
• https://git.kernel.org/stable/c/b0da97c034b6107d14e537e212d4ce8b22109a58 · Note
• https://git.kernel.org/stable/c/e3a93ce6e25757b8f375e38b8f91e1d9da4edc1a · Note
• https://git.kernel.org/stable/c/1e2bec062c5c9ec282636715166056d0998d746d · Note
• https://git.kernel.org/stable/c/e74c00c6af428a39e564cdc5bd3a3648c6d8de87 · Note
• https://git.kernel.org/stable/c/1ff46c9915c1cbf454db58a8cb87f7cac818e6a6 · Note