{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98870", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.377Z", "datePublished": "2026-10-23T11:37:07.113Z", "dateUpdated": "2026-10-24T14:09:26.805Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:26.805Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: remove stale channels from all sessions on teardown\n\nksmbd_sessions_deregister() removes a connection's channels from other\nsessions' channel lists only while conn->binding is still set:\n\n\tif (conn->binding) {\n\t\thash_for_each_safe(sessions_table, ...)\n\t\t\tksmbd_chann_del(conn, sess);\n\t}\n\nconn->binding is a transient flag: it is cleared once a binding\nSESSION_SETUP completes, and also by a subsequent non-binding\nSESSION_SETUP on the same connection (a reauthentication on a bound\nchannel, or a new SessionId==0 setup). A connection that has bound a\nchannel into another session's ksmbd_chann_list and then clears\nconn->binding leaves that channel behind when it disconnects: the\nchannel, whose chann->conn points at the now freed struct ksmbd_conn,\nstays on the owner session's list.\n\nWhen the owning connection later tears down, the second loop\ndereferences the stale channel:\n\n\txa_for_each(&sess->ksmbd_chann_list, chann_id, chann)\n\t\tif (chann->conn != conn)\n\t\t\tksmbd_conn_set_exiting(chann->conn); /* freed */\n\nwhich is a use-after-free write into the freed ksmbd_conn (the same\nstale channel is also walked by show_proc_session() through /proc). The\nsession is leaked as well, because its channel list never empties.\n\nRemove the conn->binding gate so a connection always removes its\nchannels from every session on teardown."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - TCP/445 SMB2 SESSION_SETUP messages carry SessionId and SMB2_SESSION_REQ_FLAG_BINDING into smb2_sess_setup(), which calls register_session_channel(); TCP teardown then reaches patched ksmbd_sessions_deregister() through ksmbd_server_terminate_conn().\nAC:L - On a multichannel-enabled server, one client can bind a second connection, send a non-binding SESSION_SETUP to clear conn->binding, close it, wait for its ksmbd_conn to be freed, then close the owning connection; no race or third-party state is needed.\nPR:L - smb2_sess_setup() rejects guest binding and requires a valid session; ntlm_authenticate() compares the session user and ksmbd_decode_ntlmssp_auth_blob() verifies the NTLMv2 response before register_session_channel(), requiring valid non-guest SMB credentials.\nUI:N - After authentication, the SMB client alone sends both SESSION_SETUP variants and closes the bound and owning TCP connections; no victim action is required.\nS:U - register_session_channel() stores a kernel ksmbd_conn pointer in a kernel ksmbd_session, and the stale-pointer write in ksmbd_sessions_deregister() corrupts resources within that same kernel security authority.\nC:H - register_session_channel() leaves channel::conn pointing to a freed kmalloc-backed ksmbd_conn; remotely groomed slab reuse followed by the stale dereference creates exploitable kernel memory corruption that can lead to arbitrary kernel-data disclosure.\nI:H - During owner teardown, ksmbd_sessions_deregister() passes the dangling chann->conn to ksmbd_conn_set_exiting(), writing KSMBD_SESS_EXITING into a reused slab object; this UAF corruption can be groomed for kernel data modification or control-flow hijacking.\nA:H - The stale write can corrupt a live slab object and cause an oops or panic; if the slot is reused by another ksmbd_conn, changing its status to KSMBD_SESS_EXITING also terminates that connection, and the sequence is repeatable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "versions": [{"version": "b1b6ed903a6e2b3505a48706bcd499b447ef9e44", "lessThan": "f8200bb4994e65a2e5c5b314789eeae39078619d", "status": "affected", "versionType": "git"}, {"version": "47b018dba6ec7ebf403fd2d1e713bc7acc9bbb23", "lessThan": "9cd6d714d3ca0cff296542dc989696884e41970f", "status": "affected", "versionType": "git"}, {"version": "9ef4dfd5edbd02f4bf10cd420a30896093d98a67", "lessThan": "b145f9b56c87f9c23ad5464ab0844dbc1de12b36", "status": "affected", "versionType": "git"}, {"version": "5a5b0b7a01fe19b383b3c046546b5ae30c1a7d71", "lessThan": "a15cae16f4432a5ad919ee633e31b07178492955", "status": "affected", "versionType": "git"}, {"version": "faf8578c77f3d846aca9cd882c293e03eafcc6df", "lessThan": "b10665730fbf6b5e45fe422badcbbc3f0df96ef5", "status": "affected", "versionType": "git"}, {"version": "e632f21a8bc0c59abc4960482836ac3782db93c0", "status": "affected", "versionType": "git"}, {"version": "5.15.222", "lessThan": "5.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/mgmt/user_session.c"]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.222"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f8200bb4994e65a2e5c5b314789eeae39078619d"}, {"url": "https://git.kernel.org/stable/c/9cd6d714d3ca0cff296542dc989696884e41970f"}, {"url": "https://git.kernel.org/stable/c/b145f9b56c87f9c23ad5464ab0844dbc1de12b36"}, {"url": "https://git.kernel.org/stable/c/a15cae16f4432a5ad919ee633e31b07178492955"}, {"url": "https://git.kernel.org/stable/c/b10665730fbf6b5e45fe422badcbbc3f0df96ef5"}], "title": "ksmbd: remove stale channels from all sessions on teardown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f8200bb4994e65a2e5c5b314789eeae39078619d", "status": "affected", "version": "b1b6ed903a6e2b3505a48706bcd499b447ef9e44", "versionType": "git"}, {"lessThan": "9cd6d714d3ca0cff296542dc989696884e41970f", "status": "affected", "version": "47b018dba6ec7ebf403fd2d1e713bc7acc9bbb23", "versionType": "git"}, {"lessThan": "b145f9b56c87f9c23ad5464ab0844dbc1de12b36", "status": "affected", "version": "9ef4dfd5edbd02f4bf10cd420a30896093d98a67", "versionType": "git"}, {"lessThan": "a15cae16f4432a5ad919ee633e31b07178492955", "status": "affected", "version": "5a5b0b7a01fe19b383b3c046546b5ae30c1a7d71", "versionType": "git"}, {"lessThan": "b10665730fbf6b5e45fe422badcbbc3f0df96ef5", "status": "affected", "version": "faf8578c77f3d846aca9cd882c293e03eafcc6df", "versionType": "git"}, {"status": "affected", "version": "e632f21a8bc0c59abc4960482836ac3782db93c0", "versionType": "git"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.222", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/mgmt/user_session.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux"}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: remove stale channels from all sessions on teardown\n\nksmbd_sessions_deregister() removes a connection's channels from other\nsessions' channel lists only while conn->binding is still set:\n\n\tif (conn->binding) {\n\t\thash_for_each_safe(sessions_table, ...)\n\t\t\tksmbd_chann_del(conn, sess);\n\t}\n\nconn->binding is a transient flag: it is cleared once a binding\nSESSION_SETUP completes, and also by a subsequent non-binding\nSESSION_SETUP on the same connection (a reauthentication on a bound\nchannel, or a new SessionId==0 setup). A connection that has bound a\nchannel into another session's ksmbd_chann_list and then clears\nconn->binding leaves that channel behind when it disconnects: the\nchannel, whose chann->conn points at the now freed struct ksmbd_conn,\nstays on the owner session's list.\n\nWhen the owning connection later tears down, the second loop\ndereferences the stale channel:\n\n\txa_for_each(&sess->ksmbd_chann_list, chann_id, chann)\n\t\tif (chann->conn != conn)\n\t\t\tksmbd_conn_set_exiting(chann->conn); /* freed */\n\nwhich is a use-after-free write into the freed ksmbd_conn (the same\nstale channel is also walked by show_proc_session() through /proc). The\nsession is leaked as well, because its channel list never empties.\n\nRemove the conn->binding gate so a connection always removes its\nchannels from every session on teardown."}], "id": "CVE-2026-98870", "lastModified": "2026-10-24T14:16:47.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T12:18:20.397", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9cd6d714d3ca0cff296542dc989696884e41970f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a15cae16f4432a5ad919ee633e31b07178492955"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b10665730fbf6b5e45fe422badcbbc3f0df96ef5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b145f9b56c87f9c23ad5464ab0844dbc1de12b36"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8200bb4994e65a2e5c5b314789eeae39078619d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ksmbd: remove stale channels from all sessions on teardown", "id": "2559553", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559553"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active session lists. When the owning connection is subsequently torn down, accessing these dangling references results in a use-after-free memory write, which can lead to kernel memory corruption or a Denial of Service (DoS)."], "name": "CVE-2026-98870", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98870\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98870\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98870.mbox"], "threat_severity": "Moderate"}