In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states… (CVE-2026-98901)

The Linux kernel's ksmbd module had a vulnerability in how it handled lease break and acknowledgment states. Specifically, it previously skipped valid lease states that contained WRITE_CACHING during the breaking of level-II/read leases for write and truncate operations. Additionally, the acknowledgment of lease breaks did not properly enforce the SMB2 protocol rule that the acknowledged state must be a subset of the server's break target. The fix corrects these behaviors by not skipping valid lease states and applying the acknowledged state directly while keeping the break pending if acknowledgments fail.

Improper handling of lease break and acknowledgment states could lead to inconsistencies in SMB2 lease management, potentially affecting file caching and write operations. The exact impact is not detailed, and no known exploits are reported in the wild.

A fix has been applied to the Linux kernel to resolve this vulnerability. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.