CVE-2026-99276 is a vulnerability in the Linux kernel's ksmbd component related to connection scavenging and session lock handling. The flaw involves a potential deadlock scenario where the expiration worker holds a read lock while waiting for session locks that are held by a writer queued on the same lock, causing a circular wait. The fix defers connection scavenging when session locks are busy, allowing the worker to retry later instead of blocking.