In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbd_se…
CVE-2026-98870 · GHSA-wr5r-399q-pwfr · EUVD-2026-108716 · published 23 Oct 2026
How serious is it
- Severity: high, CVSS score 8.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-98870?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: b1b6ed903a6e2b3505a48706bcd499b447ef9e44 <f8200bb4994e65a2e5c5b314789eeae39078619d
- Linux Linux: faf8578c77f3d846aca9cd882c293e03eafcc6df <b10665730fbf6b5e45fe422badcbbc3f0df96ef5
- Linux Linux: 5a5b0b7a01fe19b383b3c046546b5ae30c1a7d71 <a15cae16f4432a5ad919ee633e31b07178492955
- Linux Linux: 47b018dba6ec7ebf403fd2d1e713bc7acc9bbb23 <9cd6d714d3ca0cff296542dc989696884e41970f
- Linux Linux: 9ef4dfd5edbd02f4bf10cd420a30896093d98a67 <b145f9b56c87f9c23ad5464ab0844dbc1de12b36
- Linux Linux: e632f21a8bc0c59abc4960482836ac3782db93c0
- Linux Linux: 5.15.222 <5.16
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: remove stale channels from all sessions on teardown
ksmbd_sessions_deregister() removes a connection's channels from other
sessions' channel lists only while conn->binding is still set:
if (conn->binding) {
hash_for_each_safe(sessions_table, ...)
ksmbd_chann_del(conn, sess);
}
conn->binding is a transient flag: it is cleared once a binding
SESSION_SETUP completes, and also by a subsequent non-binding
SESSION_SETUP on the same connection (a reauthentication on a bound
channel, or a new SessionId==0 setup). A connection that has bound a
channel into another session's ksmbd_chann_list and then clears
conn->binding leaves that channel behind when it disconnects: the
channel, whose chann->conn points at the now freed struct ksmbd_conn,
stays on the owner session's list.
When the owning connection later tears down, the second loop
dereferences the stale channel:
xa_for_each(&sess->ksmbd_chann_list, chann_id, chann)
if (chann->conn != conn)
ksmbd_conn_set_exiting(chann->conn); /* freed */
which is a use-after-free write into the freed ksmbd_conn (the same
stale channel is also walked by show_proc_session() through /proc). The
session is leaked as well, because its channel list never empties.
Remove the conn->binding gate so a connection always removes its
channels from every session on teardown.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/f8200bb4994e65a2e5c5b314789eeae39078619d
- git.kernel.org/stable/c/9cd6d714d3ca0cff296542dc989696884e41970f
- git.kernel.org/stable/c/b145f9b56c87f9c23ad5464ab0844dbc1de12b36
- git.kernel.org/stable/c/a15cae16f4432a5ad919ee633e31b07178492955
- git.kernel.org/stable/c/b10665730fbf6b5e45fe422badcbbc3f0df96ef5
Merged from ENISA EUVD. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON