CVE-2026-98162

What it actually does

Failure during ksmbd_iov_pin_rsp in smb2_tree_connect leaves the tree_conn object inserted via xa_store and with counters incremented, without subsequent disconnection or release, resulting in a kernel memory leak.

Why it matters to the business

On Linux systems running SMB servers, repeated triggering can gradually exhaust kernel memory and degrade availability of file-sharing services, though current public exploit activity remains negligible 28 days after disclosure.

How an attack unfolds

An attacker with local access issues an SMB tree connect that reaches ksmbd_tree_conn_connect successfully but then fails inside ksmbd_iov_pin_rsp; the error path sets KSMBD_TREE_CONN_STATUS_NOMEM without calling the disconnect routine, permanently leaking the allocated tree_conn object.

How to fix it

Apply the upstream fix that adds explicit tree connection teardown on ksmbd_iov_pin_rsp failure; rebuild or install a Linux kernel containing the smb/server patch referenced by this advisory.

How to confirm the fix worked

Confirm the corrected error path exists in smb2_tree_connect() by inspecting kernel source or package changelog; re-test SMB tree connect under failure injection to verify no leak occurs.

Typical attack path

1. Establish local or authenticated SMB session
2. Issue smb2_tree_connect request that allocates a new tree_conn
3. Force ksmbd_iov_pin_rsp to fail (e.g., via memory pressure)
4. Observe absence of tree_conn cleanup and counter rollback

How to detect it

Review kernel logs and SMB server traces for repeated tree-connect attempts that terminate with KSMBD_TREE_CONN_STATUS_NOMEM without matching disconnect events; correlate with gradual increases in ksmbd memory consumption.

What your security team should do

• Prioritize kernel updates for all systems exposing SMB services
• Restrict local user access to ksmbd where feasible
• Monitor memory usage of SMB-related kernel objects until patched