{"id":"CVE-2026-98870","title":"kernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)","summary":"A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active s…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-825","vendor":"Red Hat","product":"Linux","affected":["Linux >= b1b6ed903a6e2b3505a48706bcd499b447ef9e44 < f8200bb4994e65a2e5c5b314789eeae39078619d","Linux >= 47b018dba6ec7ebf403fd2d1e713bc7acc9bbb23 < 9cd6d714d3ca0cff296542dc989696884e41970f","Linux >= 9ef4dfd5edbd02f4bf10cd420a30896093d98a67 < b145f9b56c87f9c23ad5464ab0844dbc1de12b36","Linux >= 5a5b0b7a01fe19b383b3c046546b5ae30c1a7d71 < a15cae16f4432a5ad919ee633e31b07178492955","Linux >= faf8578c77f3d846aca9cd882c293e03eafcc6df < b10665730fbf6b5e45fe422badcbbc3f0df96ef5","Linux e632f21a8bc0c59abc4960482836ac3782db93c0","Linux >= 5.15.222 < 5.16","Linux"],"published":"2026-10-23","updated":"2026-10-26","sourceUpdated":"2026-10-26T11:01:40+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98870.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98870.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98870"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559553"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98870"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98870"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98870.mbox"},{"url":"https://git.kernel.org/stable/c/f8200bb4994e65a2e5c5b314789eeae39078619d"},{"url":"https://git.kernel.org/stable/c/9cd6d714d3ca0cff296542dc989696884e41970f"},{"url":"https://git.kernel.org/stable/c/b145f9b56c87f9c23ad5464ab0844dbc1de12b36"},{"url":"https://git.kernel.org/stable/c/a15cae16f4432a5ad919ee633e31b07178492955"},{"url":"https://git.kernel.org/stable/c/b10665730fbf6b5e45fe422badcbbc3f0df96ef5"}],"tags":["csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00544,"epssPercentile":0.45479,"scores":{"vendor":6.5,"cna":8.8},"ingestedAt":"2026-10-23T13:24:55.586Z","slug":"CVE-2026-98870","body":"## Overview\n\nA flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active session lists. When the owning connection is subsequently torn down, accessing these dangling references results in a use-after-free memory write, which can lead to kernel memory corruption or a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98870.json)\n\n**kernel: ksmbd: remove stale channels from all sessions on teardown** — rated Moderate by Red Hat. Released 2026-10-23, updated 2026-10-26.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":229322,"id":"CVE-2026-98870","ts":1793019684412,"field":"cvss","old":"8.8","new":"6.5"},{"seq":229321,"id":"CVE-2026-98870","ts":1793019684412,"field":"severity","old":"high","new":"medium"},{"seq":228920,"id":"CVE-2026-98870","ts":1792854109775,"field":"cvss","old":null,"new":"8.8"},{"seq":228919,"id":"CVE-2026-98870","ts":1792854109775,"field":"severity","old":"none","new":"high"}]}