CVE-2026-98112

Analyzed Analyzed - Analysis Complete

ksmbd Listener Task Lifetime Issue on Netdev Events

Publication date: 2026-09-25

Last updated on: 2026-10-28

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. Create the listener in a stopped state and hold an extra task_struct reference until kthread_stop_put() completes. Also stop and release listeners before freeing their interface records during TCP teardown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-28

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98112

EUVD

EUVD-2026-86943

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.7 (exc)
linux	linux_kernel	7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition where the ksmbd listener thread could exit prematurely. The issue occurs because the netdevice notifier shuts down the listening socket before calling kthread_stop(), potentially freeing the task_struct before kthread_stop() can safely reference it. The fix involves creating the listener in a stopped state and holding an extra task_struct reference until kthread_stop_put() completes.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd component and may not have direct detection commands. Monitor kernel logs for ksmbd-related errors or crashes, especially during network interface changes. Check for listener thread exits or unexpected task_struct freeing events in system logs.

Impact Analysis

This vulnerability could lead to system instability or crashes if the ksmbd listener thread exits unexpectedly during network interface changes. It may cause denial-of-service conditions or unexpected behavior in file sharing services relying on ksmbd.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to task lifetime management in the ksmbd module, which could lead to system instability or crashes but does not involve data handling or privacy violations.

Mitigation Strategies

Update the Linux kernel to the latest patched version that includes the fix for this ksmbd listener task lifetime issue. Restart affected services or systems to ensure the updated kernel is active. Monitor system stability after applying the update.

Hi! I’m here to help you understand CVE-2026-98112. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...