---
id: "CVE-2026-98439"
kind: "vulnerability"
aliases: ["CVE-2026-98439"]
title: "Linux kernel SMB server: pending async requests can block connection close"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["file-server", "infrastructure", "kernel", "ksmbd", "linux", "self-hosted"]
not_affected_if: ["ksmbd-not-loaded"]
published_at: "2026-10-18T15:16:53+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:27:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98439", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel SMB server: pending async requests can block connection close

When a client connection to the Linux kernel's SMB server (ksmbd) closes while an asynchronous request is still waiting, the connection can fail to shut down. The fix cancels pending async requests before waiting for them to finish.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel version listed in the NVD entry (unknown in sources)
- Check whether the SMB server is loaded with `lsmod | grep ksmbd`
- Check whether the server is enabled with `systemctl status ksmbd` (unknown if sources do not say otherwise)

## Fix

- Update the Linux kernel to a release that includes the upstream commit cancelling async requests on connection close (version unknown in sources)
- Until patched, disable the SMB server if it is not needed (unknown in sources)

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98439

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

smb/server: cancel async requests when closing connection

An async request may still be waiting when a connection is closed.
This can stop the connection from closing.

Cancel active async requests before waiting for them to finish.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_