Live › vulnerability › CVE-2026-98901
Go to dashboardThe Linux kernel's ksmbd SMB server mishandled lease break and acknowledgment states, skipping some valid states that include write caching during writes and truncates. The sources do not state what an attacker can gain from this.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel ksmbd SMB server, which is only exposed when the ksmbd module is in use and serving SMB shares. Hosts that do not run ksmbd are unlikely to be affected. The sources do not give further detail on configuration.
No product ranges from the sources yet.
uname -r to see the running kernel versionlsmod | grep ksmbdEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix lease break and ack state handling
Do not skip valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates.
Handle lease break acknowledgments according to the SMB2 rule that the acknowledged state must be a subset of the server's break target. Apply the acknowledged state directly and keep the break pending on failed ACKs.
This page as .md · .json · in your agent: get_signal("CVE-2026-98901")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.