Cloudanix VulnDB

CVE-2026-98870

High · 8.8

CVSS

8.8

EPSS

0.5%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's file-sharing component can let attackers crash servers or run malicious code by manipulating network connections in a specific way.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Remote Code Execution
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Use-after-free write in ksmbd kernel module when a connection clears its binding flag after inserting a channel into another session's list, leaving a dangling pointer that is dereferenced during later session teardown or procfs access.

Why it matters to the business

Kernel memory corruption in SMB file-sharing services can cause system crashes, denial of service, or potential remote code execution on Linux servers handling network file access; rising exploit probability increases urgency for environments with exposed SMB ports.

How an attack unfolds

An attacker establishes SMB sessions that bind channels across connections, forces reauthentication or new setups to clear the binding flag, then disconnects while leaving stale channel references; subsequent teardown of the owning session dereferences the freed connection structure.

How to fix it

Apply the upstream kernel patch that removes the conn->binding conditional guard in ksmbd_sessions_deregister so channels are always cleaned from all sessions on teardown; rebuild and deploy the fixed kernel to all affected systems.

How to confirm the fix worked

Verify the patch is present by inspecting the ksmbd_sessions_deregister function for unconditional channel removal, confirm no stale channels remain via code review or testing with multi-channel SMB sessions, and monitor for kernel oops involving ksmbd_chann_list or ksmbd_conn_set_exiting.

Typical attack path

  1. Establish multiple SMB sessions and bind channels between them
  2. Trigger reauthentication or SessionId=0 setup to clear conn->binding
  3. Disconnect the connection while the channel remains on the remote session list
  4. Force teardown of the owning session to trigger the use-after-free dereference

How to detect it

Search kernel logs for oops or panic messages referencing ksmbd_chann_list, xa_for_each on sess->ksmbd_chann_list, or ksmbd_conn_set_exiting after SMB disconnects; inspect /proc sessions output for unexpected channel entries and correlate with multi-channel SMB session setups in audit logs.

What your security team should do

  • Prioritize kernel updates on any system running ksmbd within the next 30 days given the 118% EPSS increase
  • Disable ksmbd or restrict SMB access to trusted networks until patched
  • Add kernel crash and SMB session teardown monitoring to detect potential exploitation attempts

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbd_sessions_deregister() removes a connection's channels from other sessions' channel lists only while conn->binding is still set: if (conn->binding) { hash_for_each_safe(sessions_table, ...) ksmbd_chann_del(conn, sess); } conn->binding is a transient flag: it is cleared once a binding SESSION_SETUP completes, and also by a subsequent non-binding SESSION_SETUP on the same connection (a reauthentication on a bound channel, or a new SessionId==0 setup). A connection that has bound a channel into another session's ksmbd_chann_list and then clears conn->binding leaves that channel behind when it disconnects: the channel, whose chann->conn points at the now freed struct ksmbd_conn, stays on the owner session's list. When the owning connection later tears down, the second loop dereferences the stale channel: xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) if (chann->conn != conn) ksmbd_conn_set_exiting(chann->conn); /* freed */ which is a use-after-free write into the freed ksmbd_conn (the same stale channel is also walked by show_proc_session() through /proc). The session is leaked as well, because its channel list never empties. Remove the conn->binding gate so a connection always removes its channels from every session on teardown.

Affected packages

Ecosystem Package Introduced Fixed