Linux Kernel CVE-2026-98112

Requires the target host to have the in-kernel ksmbd SMB3 server (CONFIG_SMB_SERVER) built and actively running with at least one listener bound to a network interface. Exploitation is triggered by a network-device state change (interface up/down) that invokes ksmbd's netdevice notifier during listener teardown, so the attacker needs the ability to induce netdev events - typically CAP_NET_ADMIN or physical/link control - and must win a race between socket shutdown and kthread_stop(). Limiting factors: the flaw is local-only (AV:L), depends on a timing race rather than a deterministic condition, and does not affect hosts using userspace Samba instead of ksmbd or hosts where ksmbd is not loaded.

The NVD CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk for this ksmbd flaw. The technical description is a classic use-after-free race: the netdevice notifier shuts down the listener's socket (causing the listener kthread to exit and its task_struct to be freed) before kthread_stop() acquires its reference. This is a crash-dominant denial-of-service via UAF of a task_struct, with no described mechanism for reading kernel memory or corrupting attacker-chosen data - so the C:H/I:H rating is not supported by the description; a C:N/I:L/A:H shape is more honest. The AC:L rating is also questionable: exploitation depends on winning a narrow race between a network-device up/down event and listener teardown, which is better modeled as AC:H. There is no EPSS score, no CISA KEV listing, and no public exploit code, and this is a fresh 2026 stable-tree fix, so exploitation is neither confirmed nor probable. Net assessment: real priority is LOW-to-MODERATE - a local availability bug in an opt-in kernel subsystem, not a high-severity confidentiality/integrity threat despite the 7.8 label.

On a host running the in-kernel ksmbd SMB server, a local actor with the ability to toggle a network interface (or an operational link flap) triggers the netdevice notifier to shut down the listener socket while ksmbd teardown races kthread_stop(); the listener task_struct is freed and then dereferenced, panicking or corrupting the kernel. No public exploit code is available and the attack is a timing race, so reliable triggering is difficult.