{"id":"CVE-2026-98870","kind":"vulnerability","aliases":["CVE-2026-98870"],"related":[],"title":"Linux kernel ksmbd: stale SMB channels cause use-after-free on teardown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: remove stale channels from all sessions on teardown\n\nksmbd_sessions_deregister() removes a connection's channels from other\nsessions' channel lists only while conn->binding is still set:\n\n\tif (conn->binding) {\n\t\thash_for_each_safe(sessions_table, ...)\n\t\t\tksmbd_chann_del(conn, sess);\n\t}\n\nconn->binding is a transient flag: it is cleared once a binding\nSESSION_SETUP completes, and also by a subsequent non-binding\nSESSION_SETUP on the same connection (a reauthentication on a bound\nchannel, or a new SessionId==0 setup). A connection that has bound a\nchannel into another session's ksmbd_chann_list and then clears\nconn->binding leaves that channel behind when it disconnects: the\nchannel, whose chann->conn points at the now freed struct ksmbd_conn,\nstays on the owner session's list.\n\nWhen the owning connection later tears down, the second loop\ndereferences the stale channel:\n\n\txa_for_each(&sess->ksmbd_chann_list, chann_id, chann)\n\t\tif (chann->conn != conn)\n\t\t\tksmbd_conn_set_exiting(chann->conn);   /* freed */\n\nwhich is a use-after-free write into the freed ksmbd_conn (the same\nstale channel is also walked by show_proc_session() through /proc). The\nsession is leaked as well, because its channel list never empties.\n\nRemove the conn->binding gate so a connection always removes its\nchannels from every session on teardown.","summary":"The ksmbd in-kernel SMB server leaves a disconnected connection's channel on another session's channel list, so teardown writes into freed memory. The sources describe a use-after-free write and a leaked session, which can lead to memory corruption or a crash on a host running ksmbd.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ksmbd","linux-kernel","self-hosted","smb-server"],"not_affected_if":["ksmbd-not-loaded","no-smb-file-sharing","samba-userspace"],"how_to_check":"- Check whether ksmbd is loaded or enabled on the host, for example with `lsmod | grep ksmbd` or `systemctl status ksmbd`\n- Compare the running kernel with the fixed release listed in the kernel stable advisory: `uname -r`","fix":"- Update to a Linux kernel release that includes the upstream commit removing the conn->binding gate in ksmbd_sessions_deregister(); the exact fixed version is unknown from the sources\n- Until patched, unload the module with `rmmod ksmbd` if SMB serving is not needed","status":"open","published_at":"2026-10-23T12:18:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:20+00:00","updated_at":"2026-10-25T05:00:20+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:00:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit removing the conn->binding gate in ksmbd_sessions_deregister(); the exact fixed version is unknown from the sources\n- Until patched, unload the module with `rmmod ksmbd` if SMB serving is not needed","reach":"network","title":"Linux kernel ksmbd: stale SMB channels cause use-after-free on teardown","impact":"high","summary":"The ksmbd in-kernel SMB server leaves a disconnected connection's channel on another session's channel list, so teardown writes into freed memory. The sources describe a use-after-free write and a leaked session, which can lead to memory corruption or a crash on a host running ksmbd.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ksmbd","smb-server","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel memory corruption from a use-after-free write on teardown","analyst_note":"Find the fixed kernel version and whether the trigger needs an authenticated SMB session, from the NVD entry and the upstream kernel commit.","how_to_check":"- Check whether ksmbd is loaded or enabled on the host, for example with `lsmod | grep ksmbd` or `systemctl status ksmbd`\n- Compare the running kernel with the fixed release listed in the kernel stable advisory: `uname -r`","needs_analyst":true,"not_affected_if":["ksmbd-not-loaded","samba-userspace","no-smb-file-sharing"],"who_is_affected":"Only systems running the ksmbd in-kernel SMB server are described as affected, specifically those where clients bind extra SMB channels to sessions and then reauthenticate or reset on the same connection. Hosts that use Samba in userspace or do not run ksmbd can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":3733,"output_tokens":679,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98870':16A,19A '/proc':283C '0':175C 'also':152C,276C 'alway':304C 'anoth':45B,185C 'behind':199C 'bind':118C,124C,137C,147C,158C,195C,299C 'bound':169C,181C 'caus':7A 'chann':132C,189C,206C,242C,244C,246C,248C,255C 'channel':6A,43B,48B,96C,109C,113C,170C,183C,198C,204C,236C,274C,292C,307C 'clear':144C,193C 'complet':150C 'conn':117C,123C,134C,136C,194C,207C,215C,249C,250C,252C,256C,270C,298C 'connect':41B,107C,164C,178C,226C,303C 'corrupt':74B 'crash':77B 'cve':14A,17A 'del':133C 'derefer':233C 'deregist':104C 'describ':58B 'disconnect':40B,202C 'empti':295C 'everi':309C 'exit':254C 'flag':141C 'follow':88C 'free':11A,63B,264C 'freed':54B,212C,257C,268C 'gate':300C 'hash':125C 'host':27B,80B 'id':245C 'in-kernel':33B 'infrastructur':20B 'kernel':2A,24B,35B,86C 'ksmbd':3A,21B,32B,82B,93C,102C,131C,188C,214C,241C,251C,269C 'later':227C 'lead':71B 'leak':67B,287C 'leav':38B,196C 'linux':1A,23B,85C 'linux-kernel':22B 'list':49B,114C,190C,222C,243C,293C 'loop':232C 'memori':55B,73B 'never':294C 'new':173C 'non':157C 'non-bind':156C 'own':225C 'owner':219C 'point':208C 'proc':280C 'reauthent':166C 'remov':94C,105C,296C,305C 'resolv':92C 'run':81B 'safe':128C 'second':231C 'self':26B 'self-host':25B 'server':30B,37B 'sess':135C,240C 'session':46B,68B,99C,103C,112C,129C,148C,159C,186C,220C,281C,285C,310C 'sessionid':174C 'set':121C,253C 'setup':149C,160C,176C 'show':279C 'smb':5A,29B,36B 'smb-server':28B 'sourc':57B 'stale':4A,95C,235C,273C 'stay':216C 'still':120C 'struct':213C 'subsequ':155C 'tabl':130C 'tear':228C 'teardown':13A,51B,101C,312C 'transient':140C 'use':9A,61B,262C 'use-after-fre':8A,60B,261C 'vulner':89C 'walk':277C 'well':289C 'whose':205C 'write':52B,64B,265C 'xa':237C","nicknames":[],"mitigations":[],"who_affected":"Only systems running the ksmbd in-kernel SMB server are described as affected, specifically those where clients bind extra SMB channels to sessions and then reauthenticate or reset on the same connection. Hosts that use Samba in userspace or do not run ksmbd can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98870","severity":null,"published_at":"2026-10-23T12:18:20+00:00","modified_at":"2026-10-23T12:18:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}