---
id: CVE-2026-98870
title: >-
  kernel: ksmbd: remove stale channels from all sessions on teardown
  (CVE-2026-98870)
summary: >-
  A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB)
  server. A remote attacker could trigger this vulnerability by establishing and
  terminating bound SMB channels, leaving stale connection references attached
  to active s…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-825
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= b1b6ed903a6e2b3505a48706bcd499b447ef9e44 <
    f8200bb4994e65a2e5c5b314789eeae39078619d
  - >-
    Linux >= 47b018dba6ec7ebf403fd2d1e713bc7acc9bbb23 <
    9cd6d714d3ca0cff296542dc989696884e41970f
  - >-
    Linux >= 9ef4dfd5edbd02f4bf10cd420a30896093d98a67 <
    b145f9b56c87f9c23ad5464ab0844dbc1de12b36
  - >-
    Linux >= 5a5b0b7a01fe19b383b3c046546b5ae30c1a7d71 <
    a15cae16f4432a5ad919ee633e31b07178492955
  - >-
    Linux >= faf8578c77f3d846aca9cd882c293e03eafcc6df <
    b10665730fbf6b5e45fe422badcbbc3f0df96ef5
  - Linux e632f21a8bc0c59abc4960482836ac3782db93c0
  - Linux >= 5.15.222 < 5.16
  - Linux
published: '2026-10-23'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T11:01:40+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98870.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98870.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98870'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2559553'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98870'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98870'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98870.mbox
  - url: 'https://git.kernel.org/stable/c/f8200bb4994e65a2e5c5b314789eeae39078619d'
  - url: 'https://git.kernel.org/stable/c/9cd6d714d3ca0cff296542dc989696884e41970f'
  - url: 'https://git.kernel.org/stable/c/b145f9b56c87f9c23ad5464ab0844dbc1de12b36'
  - url: 'https://git.kernel.org/stable/c/a15cae16f4432a5ad919ee633e31b07178492955'
  - url: 'https://git.kernel.org/stable/c/b10665730fbf6b5e45fe422badcbbc3f0df96ef5'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00544
epssPercentile: 0.45479
scores:
  vendor: 6.5
  cna: 8.8
ingestedAt: '2026-10-23T13:24:55.586Z'
---

## Overview

A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active session lists. When the owning connection is subsequently torn down, accessing these dangling references results in a use-after-free memory write, which can lead to kernel memory corruption or a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98870.json)

**kernel: ksmbd: remove stale channels from all sessions on teardown** — rated Moderate by Red Hat. Released 2026-10-23, updated 2026-10-26.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.