CVE-2026-98901

What it actually does

The flaw permits skipping valid lease states that include WRITE_CACHING when breaking level-II or read leases during writes or truncates, and violates SMB2 rules by not ensuring acknowledged lease states are subsets of the server's break target, allowing inconsistent lease state application or retained pending breaks on failed ACKs.

Why it matters to the business

Linux servers running ksmbd may experience unstable or incorrect file access controls over SMB shares, risking data exposure or service disruption in networked file environments.

How an attack unfolds

An attacker establishes an SMB2 session to a vulnerable ksmbd server and issues lease requests or break acknowledgments containing WRITE_CACHING states or non-subset ACK values, causing the server to mishandle lease breaks and potentially bypass intended access restrictions or trigger kernel-level inconsistencies.

How to fix it

Apply the upstream kernel patch that corrects lease break state validation and SMB2 ACK subset enforcement in ksmbd; rebuild and deploy the updated kernel across affected systems.

How to confirm the fix worked

Confirm the fix by inspecting ksmbd source for the lease state subset check and WRITE_CACHING handling logic, or test with SMB2 lease break sequences that previously triggered the bug.

Typical attack path

1. Establish SMB2 connection to ksmbd server
2. Open files and request leases involving WRITE_CACHING or read levels
3. Issue writes, truncates, or crafted lease break acknowledgments
4. Exploit resulting inconsistent lease state to access or modify files improperly

How to detect it

Review ksmbd kernel logs for lease break or acknowledgment errors, and inspect SMB2 traffic for repeated lease state transitions that deviate from expected subset rules.

What your security team should do

• Prioritize kernel updates for all systems exposing ksmbd
• Restrict SMB2 access to trusted networks until patched
• Enable detailed ksmbd logging to monitor lease operations