Linux kernel ksmbd: Use-after-free via stale multichannel connections
Summary
A flaw in the in-kernel SMB server ksmbd leaves channels of disconnected connections on other sessions after teardown. When the owning connection later closes, the kernel writes to freed memory, and the session is leaked. The record links the path to SMB session setup and channel binding; the authentication requirement is not verified against a vendor source. Impact depends on whether ksmbd is in use at all, as most SME file sharing runs on Samba.
Affected
- Linux kernel with ksmbd, per the CNA commit ranges (for example from b1b6ed903a6e2b3505a48706bcd499b447ef9e44 to before f8200bb4994e65a2e5c5b314789eeae39078619d)
- Affected range from 5.15.222 to before 5.16 is listed by a third-party source and is unverified
- Fixed kernel release numbers: Unknown.
Fixed in
- Kernel.org stable commits: f8200bb4994e65a2e5c5b314789eeae39078619d, 9cd6d714d3ca0cff296542dc989696884e41970f, b145f9b56c87f9c23ad5464ab0844dbc1de12b36, a15cae16f4432a5ad919ee633e31b07178492955, b10665730fbf6b5e45fe422badcbbc3f0df96ef5
- Fixed distribution kernel versions: Unknown.
Workaround
- Unknown. No workaround found; the fix is the kernel patch.
- Possible mitigation: disable or do not load ksmbd if it is not required, and restrict port 445 to trusted networks.
Exploitation
- No known exploitation as of the research date.
- No CISA KEV listing and no public proof of concept found. Absence in these sources is not proof that exploitation is absent.
- Scores differ: CVSS 8.8 in the record; SUSE shows 6.5 (Medium); Ubuntu rates it Medium priority.
Our recommendation
- Check whether ksmbd is loaded on any host (lsmod | grep ksmbd). If it is not, the risk is low.
- If it is loaded, apply the distribution's kernel update as soon as it is available.
- Until patched, block SMB (port 445) from untrusted networks or disable ksmbd.
- Recheck NVD and CISA KEV in a few days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit f8200bb4994e65a2e5c5b314789eeae39078619d git.kernel.org
- Linux kernel stable commit 9cd6d714d3ca0cff296542dc989696884e41970f git.kernel.org
- Linux kernel stable commit b145f9b56c87f9c23ad5464ab0844dbc1de12b36 git.kernel.org
- Linux kernel stable commit a15cae16f4432a5ad919ee633e31b07178492955 git.kernel.org
- Linux kernel stable commit b10665730fbf6b5e45fe422badcbbc3f0df96ef5 git.kernel.org
- Ubuntu security notice CVE-2026-98870 ubuntu.com
- NVD-derived record on Vulners vulners.com
- SUSE CVE listing on Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:47.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbd_sessions_deregister() removes a connection's channels from other sessions' channel lists only while conn->binding is still set: if (conn->binding) { hash_for_each_safe(sessions_table, ...) ksmbd_chann_del(conn, sess); } conn->binding is a transient flag: it is cleared once a binding SESSION_SETUP completes, and also by a subsequent non-binding SESSION_SETUP on the same connection (a reauthentication on a bound channel, or a new SessionId==0 setup). A connection that has bound a channel into another session's ksmbd_chann_list and then clears conn->binding leaves that channel behind when it disconnects: the channel, whose chann->conn points at the now freed struct ksmbd_conn, stays on the owner session's list. When the owning connection later tears down, the second loop dereferences the stale channel: xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) if (chann->conn != conn) ksmbd_conn_set_exiting(chann->conn); /* freed */ which is a use-after-free write into the freed ksmbd_conn (the same stale channel is also walked by show_proc_session() through /proc). The session is leaked as well, because its channel list never empties. Remove the conn->binding gate so a connection always removes its channels from every session on teardown.
NVD references (5)
- https://git.kernel.org/stable/c/9cd6d714d3ca0cff296542dc989696884e41970f
- https://git.kernel.org/stable/c/a15cae16f4432a5ad919ee633e31b07178492955
- https://git.kernel.org/stable/c/b10665730fbf6b5e45fe422badcbbc3f0df96ef5
- https://git.kernel.org/stable/c/b145f9b56c87f9c23ad5464ab0844dbc1de12b36
- https://git.kernel.org/stable/c/f8200bb4994e65a2e5c5b314789eeae39078619d
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.