CVE-2026-98901 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix lease break and ack state handling
Do not skip valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates.
Handle lease break acknowledgments according to the SMB2 rule that the acknowledged state must be a subset of the server's break target. Apply the acknowledged state directly and keep the break pending on failed ACKs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The ksmbd component within the Linux kernel, which provides an implementation of the Server Message Block protocol for file sharing, has addressed critical issues related to lease management that could lead to data corruption or denial of service conditions. SMB2 leases are a mechanism used by clients and servers to negotiate caching behaviors, allowing clients to hold locks on files while performing read or write operations without constant server interaction. The vulnerability stemmed from an incorrect handling of state transitions during the breaking of these leases, specifically when transitioning from level-II or read-only states to modes that permit writing or truncating. In previous implementations, valid lease states containing WRITE_CACHING permissions were erroneously skipped during this break process. This logic flaw meant that a client might retain write caching capabilities even after the server had revoked them due to another party requesting exclusive access or modification rights. Such a discrepancy between the actual file state and the cached data held by the client can result in significant data integrity issues, where writes are lost or overwritten incorrectly because the client continues to cache changes locally under the false assumption that it still holds write privileges.
Beyond the incorrect state skipping, the implementation failed to strictly adhere to SMB2 protocol specifications regarding lease break acknowledgments. According to the standard, when a server sends a lease break request specifying a target state, any acknowledgment from the client must represent a subset of that requested target state. The previous code did not enforce this constraint properly, potentially accepting invalid states or mishandling the transition logic when an acknowledgment was received. This lack of strict validation allows for ambiguous session states where the server and client disagree on the current lease level. Furthermore, the handling of failed acknowledgments was flawed; instead of maintaining a pending break state to force re-evaluation or retry mechanisms as required by robust protocol implementations, the system may have proceeded with incorrect assumptions about file access rights. These defects collectively undermine the reliability of networked file sharing services running on Linux systems exposed to untrusted SMB clients.
The operational impact of these vulnerabilities is severe for environments relying on ksmbd for high-performance or critical data storage. Data corruption remains the primary risk, as write caching errors can lead to silent data loss where applications believe their writes have been persisted but are actually discarded due to lease state mismatches. Additionally, improper handling of lease breaks can cause clients to hang indefinitely waiting for acknowledgments that never arrive correctly, leading to denial of service scenarios for users accessing shared resources. Attackers with the ability to interact with the SMB service could potentially exploit these logic errors to disrupt services or manipulate file states in ways that bypass intended access controls, although exploitation typically requires specific timing and state manipulation capabilities against the ksmbd daemon.
Mitigation strategies primarily involve applying the kernel updates provided by distribution vendors which include the corrected lease break and acknowledgment handling logic. Administrators should ensure their systems are patched to versions of the Linux kernel where these ksmbd fixes have been integrated. For environments unable to immediately patch, restricting access to SMB shares through network segmentation or firewall rules can reduce exposure to untrusted clients. It is also advisable to monitor for unusual patterns in file locking and lease break requests that might indicate exploitation attempts. Long-term resilience requires adhering to industry standards such as CWE-20 Improper Input Validation and CWE-367 Time-of-check Time-of-use (TOCTOU) flaws, ensuring that state transitions are atomic and strictly validated against protocol specifications like those defined in the SMB2 standard. Aligning with MITRE ATT&CK techniques related to Defense Evasion or Impact categories can help in detecting anomalous behavior associated with these specific protocol-level exploits.