---
id: "CVE-2026-98901"
kind: "vulnerability"
aliases: ["CVE-2026-98901"]
title: "Linux kernel: ksmbd lease break handling can mis-grant cache state"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "ksmbd", "linux", "self-hosted", "smb"]
not_affected_if: ["ksmbd-not-loaded"]
published_at: "2026-10-23T12:18:24+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98901", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98901", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: ksmbd lease break handling can mis-grant cache state

The Linux kernel's ksmbd SMB server mishandled lease break and acknowledgment states, skipping some valid states that include write caching during writes and truncates. The sources do not state what an attacker can gain from this.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version
- Check whether the ksmbd module is loaded with `lsmod | grep ksmbd`
- unknown for the exact affected kernel version ranges

## Fix

- Update to a Linux kernel release that includes the ksmbd lease break fix (exact fixed version: unknown)
- unknown for any setting change or workaround

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98901
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98901

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix lease break and ack state handling

Do not skip valid lease states containing WRITE_CACHING when breaking
level-II/read leases for writes and truncates.

Handle lease break acknowledgments according to the SMB2 rule that the
acknowledged state must be a subset of the server's break target. Apply
the acknowledged state directly and keep the break pending on failed ACKs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_