CVE-2026-98115 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: safely drain sessions during logoff
SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects.
A deferred byte-range lock remains counted as a running request and only wakes when its file closes. Wake blocked locks during the drain without unpublishing or modifying their file objects. Synchronous CANCEL requests must invoke their cancellation callback to wake pending operations, while CHANGE_NOTIFY completion remains specific to the asynchronous path.
Serialize session teardown with channel registration and previous-session cleanup, and use atomic work-state transitions so LOGOFF, CANCEL, and connection teardown invoke cancellation callbacks only once.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability addressed in this update pertains to the ksmbd implementation within the Linux kernel, specifically concerning the handling of SMB3 multichannel sessions during logoff procedures. SMB3 multichannel is a feature that allows a single session to utilize multiple network connections simultaneously for improved throughput and redundancy. However, the previous implementation contained race conditions and synchronization flaws when tearing down these complex session structures. The core issue arises because shared session objects were being freed while requests associated with those sessions were still in flight or pending completion across various channels. This premature deallocation can lead to use-after-free scenarios where kernel memory is accessed after it has been returned to the system, potentially causing kernel panics, data corruption, or arbitrary code execution if an attacker can manipulate the timing of session teardowns and channel operations.
The technical flaw involves several specific operational states that were not properly synchronized during the logoff process. First, deferred byte-range locks remained counted as active requests but only woke up when their associated file objects were closed, rather than being explicitly woken during session drain. This delay can cause hangs or inconsistent state transitions where resources are held indefinitely. Second, synchronous CANCEL requests failed to invoke their cancellation callbacks immediately, leaving pending operations in an ambiguous state that could be exploited for denial of service conditions. Additionally, CHANGE_NOTIFY completions were not correctly handled within the asynchronous path relative to session teardown, leading to potential memory leaks or invalid pointer dereferences when notifications triggered after the underlying structures had been partially dismantled.
From a security architecture perspective, this vulnerability aligns with CWE-416: Use After Free and CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). The lack of proper serialization between session teardown and channel registration allowed for race conditions where the kernel state could be manipulated by concurrent operations. In terms of MITRE ATT&CK, this relates to techniques involving resource manipulation that can lead to denial of service or privilege escalation depending on how the memory corruption is exploited. An attacker with network access to an SMB share running vulnerable ksmbd code could potentially trigger these race conditions through carefully timed multichannel connections and cancellation requests, disrupting service availability or compromising system integrity.
To mitigate this vulnerability, the fix implements a robust serialization mechanism for session teardown that coordinates closely with channel registration and previous-session cleanup processes. The solution ensures that all channels bound to a session are fully drained before any shared session objects are freed, preventing premature deallocation of critical kernel structures. Deferred byte-range locks are now explicitly woken during the drain process without modifying their file objects, ensuring clean state transitions. Synchronous CANCEL requests are mandated to invoke their cancellation callbacks immediately, waking pending operations and clearing associated resources atomically. Furthermore, atomic work-state transitions were introduced so that LOGOFF, CANCEL, and connection teardown routines invoke cancellation callbacks exactly once, eliminating duplicate processing or missed signals. System administrators should apply the latest kernel updates containing this ksmbd patch to ensure proper synchronization of multichannel session lifecycles and maintain system stability against race condition exploits.