Linux ksmbd CVE-2026-98870

Requires that the target Linux host has the ksmbd in-kernel SMB server (CONFIG_SMB_SERVER) built and actively serving, and that the attacker can establish an authenticated SMB3 session supporting multichannel (PR:L). The concrete trigger stated in the description: a connection binds a channel into another session's ksmbd_chann_list, then conn->binding is cleared - either by the binding SESSION_SETUP completing, a reauthentication on a bound channel, or a new SessionId==0 SESSION_SETUP - so the channel is left behind on disconnect; the subsequent owner teardown then dereferences the stale channel. Limiting factors: ksmbd is not enabled in most deployments, valid SMB credentials are needed, and SMB3 multichannel must be in use, all of which sharply narrow realistic exposure beyond the raw CVSS.

Signals are consistent in pointing to a real-but-not-urgent issue. The input CVSS is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and the vuln.today decision label is 'this_week', yet EPSS is only 0.25% (16th percentile) and there is no CISA KEV listing - no public exploit identified at time of analysis (the only references are the kernel stable fix commits, not PoC code). The high CVSS is driven by the kernel-level memory-corruption impact (a use-after-free write into a freed struct ksmbd_conn, plus a parallel stale-channel walk via /proc in show_proc_session()), but the input vector's AC:L understates the trigger: the description requires a specific SMB3 multichannel sequence (bind a channel into another session, clear conn->binding via reauthentication or a new SessionId==0 setup, then disconnect), which is a non-trivial orchestration rather than a single crafted packet. Crucially, exploitation presupposes the in-kernel ksmbd SMB server is compiled in and running and that the attacker holds an authenticated SMB session (PR:L) - conditions absent from the large majority of Linux deployments. Tag conflict to note: the input Tag 'Information Disclosure' does not match the described primary defect, which is a UAF write and a session/memory leak (memory corruption / potential DoS), not disclosure. Net: a legitimately high-severity kernel flaw where real-world risk is bounded by the uncommon ksmbd deployment footprint and the authenticated, multichannel-specific trigger.

An attacker with valid credentials to a Linux host running the ksmbd in-kernel SMB server opens an SMB3 multichannel session, binds a channel into another session's channel list, then issues a reauthenticating or new SESSION_SETUP that clears conn->binding, and disconnects - leaving a stale channel whose conn pointer references freed memory. When the owning connection later tears down, the kernel performs a use-after-free write into the freed ksmbd_conn, corrupting kernel memory. No public exploit code has been identified; this is an authenticated, local-network-service attack path.