In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown… (CVE-2026-98870)

The vulnerability in the Linux kernel's ksmbd subsystem involves improper cleanup of stale channels during connection teardown. The function ksmbd_sessions_deregister() only removed a connection's channels from other sessions' channel lists while the connection's binding flag was set. Since conn->binding is cleared after SESSION_SETUP completes or on reauthentication, channels could remain in session lists after the connection disconnects. This caused use-after-free writes when the owning connection later tore down, as stale channels referenced freed ksmbd_conn structures. Additionally, sessions leaked because their channel lists were never emptied. The fix removes the conditional check on conn->binding, ensuring all channels are removed from every session on teardown.

This vulnerability results in use-after-free memory corruption within the ksmbd kernel module, which can lead to kernel memory corruption and session leaks. Such conditions may cause system instability or crashes. No known exploits in the wild have been reported.

A fix has been applied in the Linux kernel to remove the conn->binding check so that stale channels are always removed from all sessions on connection teardown. Users should update to the patched kernel version containing this fix once available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.