rootpwn

critical · CVSS v3 8.8

CVE-2026-98115

The Linux kernel ksmbd component had a critical flaw that allowed session teardown during SMB3 multichannel logoff to leave requests running

Overview

The Linux kernel ksmbd component had a critical flaw that allowed session teardown during SMB3 multichannel logoff to leave requests running on multiple connections, potentially causing resource leaks and denial of service. The patch ensures proper draining of sessions and cancellation callbacks. This affects any system running the kernel with ksmbd enabled.

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lock remains counted as a running request and only wakes when its file closes. Wake blocked locks during the drain without unpublishing or modifying their file objects. Synchronous CANCEL requests must invoke their cancellation callback to wake pending operations, while CHANGE_NOTIFY completion remains specific to the asynchronous path. Serialize session teardown with channel registration and previous-session cleanup, and use atomic work-state transitions so LOGOFF, CANCEL, and connection teardown invoke cancellation callbacks only once.

Impact

The vulnerability primarily impacts availability by allowing attackers to exhaust kernel resources or cause hanging SMB sessions. It could also lead to inconsistent session state, potentially affecting integrity of file operations. Confidentiality is not directly compromised.

Remediation

Apply the latest kernel update that includes the CVE-2026-98115 fix. If immediate patching is not possible, disable ksmbd or SMB3 multichannel support, or switch to a user-space SMB implementation such as Samba. Use firewall rules to limit SMB traffic and monitor for abnormal session activity. Ensure kernel hardening options are enabled.

Risk context

Severity is critical with a CVSS v3 score of 8.8. No EPSS data is available, but the lack of a patch in current kernels makes this a high‑priority issue for defenders.

Affected products

  • Linux kernel
  • Red Hat Enterprise Linux
  • Ubuntu
  • Debian
  • CentOS
  • Fedora
  • SUSE Linux Enterprise Server
  • Oracle Linux

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
—
EPSS
—

Linux kernel SMB ksmbd DoS critical availability resource exhaustion

← All CVEs

Related CVEs

critical

CVE-2026-97995

CVE-2026-97995 is a Linux kernel memory-safety flaw in the virtio_console driver. During device removal, leftover control-out virtqueue cookies can be misinterpreted as port buffers, causing an out-of-bounds read of the ports_device object. It matters because virtio-console is used in virtualized Linux environments and the bug can be triggered during device unbind.

View analysis

critical

CVE-2026-98024

CVE-2026-98024 is a critical flaw in the Linux kernel’s s390/ism subsystem that can corrupt the slab allocator and lead to a use‑after‑free. The bug occurs when folio_put() is incorrectly replaced by kfree() during error handling in ism_alloc_dmb(). It can allow attackers to gain arbitrary code execution or cause a denial of service on affected systems.

View analysis

critical

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

View analysis

critical

CVE-2026-95832

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and = are consumed as delimiters, but every other printable character survives, which is sufficient to compose a shell command. A newline is available from handle_remote_ssh() in kitty/window.py, which writes the bytes yielded by get_ssh_data() in kittens/ssh/utils.py, the first of which begin with a newline, to the pseudoterminal master before any credential carried in the request is checked. The reply is framed as an OSC sequence carrying the escape code number, the field name, and the literal value ?. This results in execution of an attacker-chosen command with the privileges of the user running the terminal.

View analysis