CVE-2026-98115
Received Received - Intake

ksmbd Session Drain Vulnerability in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lock remains counted as a running request and only wakes when its file closes. Wake blocked locks during the drain without unpublishing or modifying their file objects. Synchronous CANCEL requests must invoke their cancellation callback to wake pending operations, while CHANGE_NOTIFY completion remains specific to the asynchronous path. Serialize session teardown with channel registration and previous-session cleanup, and use atomic work-state transitions so LOGOFF, CANCEL, and connection teardown invoke cancellation callbacks only once.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98115
EUVD
EUVD-2026-86946

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ksmbd SMB3 multichannel implementation. It allows requests for one session to run on multiple connections. The issue occurs during session logoff where shared session objects are freed before all channels bound to a session are properly drained, potentially leading to use-after-free or memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation. Detection requires checking kernel logs for session teardown issues or SMB3 multichannel errors. Use commands like dmesg | grep ksmbd or journalctl -u ksmbd to review logs for related errors.

Impact Analysis

An attacker could exploit this to cause a denial of service, crash the system, or potentially execute arbitrary code with kernel privileges. Systems using ksmbd with SMB3 multichannel enabled are at risk of instability or compromise.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Disable ksmbd if not needed. Monitor SMB3 multichannel sessions for abnormal behavior. Restrict access to SMB shares until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart