Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-98870— ksmbd: remove stale channels from all sessions on teardown

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复： ksmbd：在连接断开时，从所有会话中移除过期的通道（channels）。 ksmbd_sessions_deregister() 函数仅当 conn->binding 标志仍被设置时，才会将某个连接（connection）的通道从其他会话的通道列表中移除： conn->binding 是一个临时标志：一旦绑定会话（binding SESSION_SETUP）完成，该标志即被清除；此外，若在同一连接上随后执行非绑定会话设置（例如在已绑定通道上重新认证，或创建 Sessio

CVSS 8.8 · High EPSS 0.25% · P16 Updated Oct 24, 2026

Possible ATT&CK Techniques 1 AI

T1068.004

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`b1b6ed903a6e2b3505a48706bcd499b447ef9e44< f8200bb4994e65a2e5c5b314789eeae39078619d`	affected
		`47b018dba6ec7ebf403fd2d1e713bc7acc9bbb23< 9cd6d714d3ca0cff296542dc989696884e41970f`	affected
		`9ef4dfd5edbd02f4bf10cd420a30896093d98a67< b145f9b56c87f9c23ad5464ab0844dbc1de12b36`	affected
		`5a5b0b7a01fe19b383b3c046546b5ae30c1a7d71< a15cae16f4432a5ad919ee633e31b07178492955`	affected
		`faf8578c77f3d846aca9cd882c293e03eafcc6df< b10665730fbf6b5e45fe422badcbbc3f0df96ef5`	affected
		`e632f21a8bc0c59abc4960482836ac3782db93c0`	affected
		`5.15.222< 5.16`	affected
		`any`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ksmbd: remove stale channels from all sessions on teardown

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbd_sessions_deregister() removes a connection's channels from other sessions' channel lists only while conn->binding is still set: if (conn->binding) { hash_for_each_safe(sessions_table, ...) ksmbd_chann_del(conn, sess); } conn->binding is a transient flag: it is cleared once a binding SESSION_SETUP completes, and also by a subsequent non-binding SESSION_SETUP on the same connection (a reauthentication on a bound channel, or a new SessionId==0 setup). A connection that has bound a channel into another session's ksmbd_chann_list and then clears conn->binding leaves that channel behind when it disconnects: the channel, whose chann->conn points at the now freed struct ksmbd_conn, stays on the owner session's list. When the owning connection later tears down, the second loop dereferences the stale channel: xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) if (chann->conn != conn) ksmbd_conn_set_exiting(chann->conn); /* freed */ which is a use-after-free write into the freed ksmbd_conn (the same stale channel is also walked by show_proc_session() through /proc). The session is leaked as well, because its channel list never empties. Remove the conn->binding gate so a connection always removes its channels from every session on teardown.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	b1b6ed903a6e2b3505a48706bcd499b447ef9e44 ~ f8200bb4994e65a2e5c5b314789eeae39078619d	-
Linux	Linux	-	-

II. Public POCs for CVE-2026-98870

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-98870

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98870 (3)

https://www.cve.org/CVERecord?id=CVE-2026-98870

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98959	9.8 CRITICAL	btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99079	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-99078	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99083	8.8 HIGH	ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082	8.8 HIGH	KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98988	8.8 HIGH	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98981	8.8 HIGH	namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98980	8.8 HIGH	namei: don't reveal overmounted entries in refwalk
CVE-2026-98978	8.4 HIGH	namespace: never expire a locked mount
CVE-2026-99042	8.4 HIGH	io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-99064	8.1 HIGH	cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968	8.1 HIGH	amt: send the relay's General Query directly from the receive path
CVE-2026-98899	7.8 HIGH	netfilter: ipset: mark the rcu locked areas properly
CVE-2026-98945	7.8 HIGH	HID: steam: Rearrange teardown sequence
CVE-2026-99056	7.8 HIGH	strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-98944	7.8 HIGH	HID: steam: Refactor registration
CVE-2026-99054	7.8 HIGH	tipc: destroy topsrv workqueues before closing connections
CVE-2026-99053	7.8 HIGH	tipc: hold a reference to nodes found by link name
CVE-2026-98993	7.8 HIGH	namespace: don't inherit MNT_UMOUNT in clone_mnt()
CVE-2026-98999	7.8 HIGH	drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

Showing top 20 of 218 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux