CVE-2026-99279 addresses a vulnerability in the Linux kernel's ksmbd component related to session management. The flaw involved ended SMB sessions retaining memory and connection slots after logoff or expiration, potentially leading to resource retention issues. The fix ensures that ended sessions are properly reclaimed and removed from global tables and procfs entries, preventing stale session data from persisting. This includes unlinking sessions from connections and disposing of them safely outside locks to avoid concurrency issues.