Linux Kernel EUVD-2026-86946

Requires the kernel built and running with ksmbd (CONFIG_SMB_SERVER) actively exporting at least one SMB3 share, and an SMB3 client that authenticates (PR:L) and negotiates multichannel so multiple connections bind to one session. Exploitation then depends on racing a LOGOFF, synchronous CANCEL, or abrupt connection teardown against still-running requests - specifically a deferred byte-range lock that remains counted until its file closes, or a pending CANCEL - so the shared session objects are freed while a bound channel still references them. Limiting factors: ksmbd is not enabled by default and is far less common than userspace Samba; valid credentials are required; and success hinges on winning a narrow teardown/quiesce race window (non-deterministic, AC:H). Impact is a kernel crash / denial of service, not data disclosure.

This is a Linux kernel ksmbd (in-kernel SMB3 server) session-teardown race that, in impact terms, is a use-after-free / DoS - not the 'Information Disclosure' its tag claims and not the confidentiality/integrity compromise the CVSS suggests. NVD assigns 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Two metrics are questionable: AC:L understates that the bug is a race between LOGOFF/CANCEL/connection-teardown and in-flight requests (deferred byte-range locks, CANCEL callbacks) across multichannel connections - winning that window is not deterministic, so AC:H is more honest; and C:H/I:H overstate a fix whose described effect is safe draining/waking of blocked work, i.e. preventing UAF of freed shared session objects, which manifests as crash/corruption (A:H) rather than data theft. AV:N and PR:L ARE defensible here, unlike sibling ksmbd bug CVE-2026-98112 which is local (netdev race): this one is reachable over SMB by an authenticated client that establishes a multichannel session. No EPSS, no CISA KEV, and no public PoC accompany the record, and there is no evidence of exploitation. Net: a real but conditional authenticated-remote DoS in a niche opt-in feature - meaningful for the small population that exports ksmbd shares, but the headline 8.8 overstates real-world priority; a tempered ~6.3 is more representative. Note the input CPE is only the generic 'linux:linux' string and does not encode the ksmbd component or fixed versions - rely on the kernel.org commit references for scoping.

An authenticated SMB3 client connects to a ksmbd-exported share, negotiates multichannel to bind multiple connections to one session, issues operations that leave requests pending (e.g. a deferred byte-range lock or a CANCEL), then races a LOGOFF or abrupt connection teardown against those in-flight requests. If teardown frees the shared session objects before all bound channels quiesce, the kernel accesses freed memory, causing corruption or a panic. No public exploit code is identified at time of analysis.