{"id":"CVE-2026-98901","kind":"vulnerability","aliases":["CVE-2026-98901"],"related":[],"title":"Linux kernel: ksmbd lease break handling can mis-grant cache state","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix lease break and ack state handling\n\nDo not skip valid lease states containing WRITE_CACHING when breaking\nlevel-II/read leases for writes and truncates.\n\nHandle lease break acknowledgments according to the SMB2 rule that the\nacknowledged state must be a subset of the server's break target. Apply\nthe acknowledged state directly and keep the break pending on failed ACKs.","summary":"The Linux kernel's ksmbd SMB server mishandled lease break and acknowledgment states, skipping some valid states that include write caching during writes and truncates. The sources do not state what an attacker can gain from this.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","ksmbd","linux","self-hosted","smb"],"not_affected_if":["ksmbd-not-loaded"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the ksmbd module is loaded with `lsmod | grep ksmbd`\n- unknown for the exact affected kernel version ranges","fix":"- Update to a Linux kernel release that includes the ksmbd lease break fix (exact fixed version: unknown)\n- unknown for any setting change or workaround","status":"open","published_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:59:53+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-10-25T04:59:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the ksmbd lease break fix (exact fixed version: unknown)\n- unknown for any setting change or workaround","reach":"network","title":"Linux kernel: ksmbd lease break handling can mis-grant cache state","impact":"low","summary":"The Linux kernel's ksmbd SMB server mishandled lease break and acknowledgment states, skipping some valid states that include write caching during writes and truncates. The sources do not state what an attacker can gain from this.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","ksmbd","smb","self-hosted"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the impact","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected version range, the CVSS score and what a client can actually gain from the cache state error.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the ksmbd module is loaded with `lsmod | grep ksmbd`\n- unknown for the exact affected kernel version ranges","needs_analyst":true,"not_affected_if":["ksmbd-not-loaded"],"who_is_affected":"Systems running the Linux kernel ksmbd SMB server, which is only exposed when the ksmbd module is in use and serving SMB shares. Hosts that do not run ksmbd are unlikely to be affected. The sources do not give further detail on configuration.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3368,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98901':15A,18A '/read':94C 'accord':104C 'ack':77C,135C 'acknowledg':38B,103C,111C,125C 'appli':123C 'attack':59B 'break':5A,36B,75C,90C,102C,121C,131C 'cach':11A,47B,88C 'contain':86C 'cve':13A,16A 'direct':127C 'fail':134C 'fix':73C 'follow':67C 'gain':61B 'grant':10A 'handl':6A,79C,100C 'host':25B 'ii':93C 'includ':45B 'infrastructur':19B 'keep':129C 'kernel':2A,20B,29B,65C 'ksmbd':3A,21B,31B,72C 'leas':4A,35B,74C,84C,95C,101C 'level':92C 'level-ii':91C 'linux':1A,22B,28B,64C 'mis':9A 'mis-grant':8A 'mishandl':34B 'must':113C 'pend':132C 'resolv':71C 'rule':108C 'self':24B 'self-host':23B 'server':33B,119C 'skip':40B,82C 'smb':26B,32B 'smb2':107C 'sourc':53B 'state':12A,39B,43B,56B,78C,85C,112C,126C 'subset':116C 'target':122C 'truncat':51B,99C 'valid':42B,83C 'vulner':68C 'write':46B,49B,87C,97C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel ksmbd SMB server, which is only exposed when the ksmbd module is in use and serving SMB shares. Hosts that do not run ksmbd are unlikely to be affected. The sources do not give further detail on configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98901","severity":null,"published_at":"2026-10-23T12:18:24+00:00","modified_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98901","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98901","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}