CVE-2026-52911

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: scope conn->binding slowpath to bound sessions only

When the binding SESSION_SETUP sets conn->binding = true, the flag stays

set after the call so that the global session lookup in

ksmbd_session_lookup_all() can find the session, which was not added to

conn->sessions. Because the flag is connection-wide, the global lookup

path will also resolve any other session by id if asked.

Tighten the global lookup so that the returned session must have this

connection registered in its channel xarray (sess->ksmbd_chann_list).

The channel entry is installed by the existing binding_session path in

ntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes

successfully, so this condition is a strict equivalent of "this

connection has been accepted as a channel of this session". Connections

that have not bound to a given session cannot reach it via the global

table.

The existing conn->binding gate for entering the slowpath is preserved

so that non-binding connections keep the fast-path-only behavior, and

the session->state check is unchanged.