Linux Kernel ksmbd ksmbd_session_register session expiration

Summaryinfo

A vulnerability was found in Linux Kernel. It has been classified as problematic. The affected element is the function ksmbd_session_register of the component ksmbd. Performing a manipulation results in session expiration. This vulnerability is known as CVE-2026-98420. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Linux Kernel (unknown version). It has been classified as problematic. This affects the function ksmbd_session_register of the component ksmbd. The manipulation with an unknown input leads to a session expiration vulnerability. CWE is classifying the issue as CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." This is going to have an impact on integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbd_session_register() destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with Session.ExpirationTime. Windows can create additional authenticated sessions on an existing connection, so deleting the older session invalidates its tree connects and makes mapped drives fail with STATUS_NETWORK_NAME_DELETED. The session expiration rules require the server to change a valid session to expired only after its credential expiration time passes. A valid or expired session otherwise keeps its connection from being scavenged. Connections that have not negotiated a dialect, have no sessions, or have only InProgress sessions are disconnected after an implementation-specific timeout. Use the Windows-compatible 45 second value and run the expiration check periodically for both TCP and SMB Direct. Keep zero as an infinite credential expiration time, and count each Valid-to-Expired transition. Set expired sessions to InProgress when they reauthenticate. If authentication fails, remove the session from the global and per-connection tables immediately, including SMB3 multichannel connections. Retain protection against abandoned SessionId-zero exchanges by allowing only one InProgress authentication per connection. Additional exchanges fail with STATUS_INSUFFICIENT_RESOURCES, and stale InProgress sessions are reaped after the same 45 second setup timeout. This bounds the original unauthenticated memory-exhaustion path without evicting established sessions.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-98420 since 09/25/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/14/2026).

Applying the patch c99ea7855124ca1428a1e59c2b4590aaef34eacf is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion