CVE-2026-98115

Status: Undergoing AnalysisHigh (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: safely drain sessions during logoff

SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects.

A deferred byte-range lock remains counted as a running request and only wakes when its file closes. Wake blocked locks during the drain without unpublishing or modifying their file objects. Synchronous CANCEL requests must invoke their cancellation callback to wake pending operations, while CHANGE_NOTIFY completion remains specific to the asynchronous path.

Read full descriptionShow less

Serialize session teardown with channel registration and previous-session cleanup, and use atomic work-state transitions so LOGOFF, CANCEL, and connection teardown invoke cancellation callbacks only once.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 8.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.27%
Percentile among all scored CVEs: 17
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement65 %
Primary impactT1499.004 Application or System Exploitationimpact60 %
Secondary impactT1078.002 Domain Accountsstealth · persistence · privilege escalation · initial access55 %

AV:N/PR:L indica explotación remota de servicio SMB3 (T1210). La falta de sincronización en drenaje de sesiones permite DoS (bloqueos no despiertan) y potencial bypass de autenticación multichannel.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Vulnerability Scanning User Training User Account Management Threat Intelligence Program Password Policies

Affected technologies (1)

Linux — Linux Kernel

CWEs

CWE-362

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-98115",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "76e98a158b207771a6c9a0de0a60522a446a3447",
              "lessThan": "a7e6df0bb92642bee4431b2b85c69ada1e463b21",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "76e98a158b207771a6c9a0de0a60522a446a3447",
              "lessThan": "d12168084c8c1b6d883c8eca5853929ac5136a9e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "118fd997612d1efc94a86c307c6c6d659ebe29fc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c1e55020534c4aafbc38d8f5c4583ff30755ac18",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6.6.48",
              "lessThan": "6.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.10.7",
              "lessThan": "6.11",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "fs/smb/server/connection.c",
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/mgmt/user_session.h",
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/vfs_cache.c",
            "fs/smb/server/vfs_cache.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.11",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/smb/server/connection.c",
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/mgmt/user_session.h",
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/vfs_cache.c",
            "fs/smb/server/vfs_cache.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:42.667",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/a7e6df0bb92642bee4431b2b85c69ada1e463b21",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d12168084c8c1b6d883c8eca5853929ac5136a9e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: safely drain sessions during logoff\n\nSMB3 multichannel allows requests for one session to run on multiple\nconnections. Wait for all channels bound to a session before freeing\nshared session objects.\n\nA deferred byte-range lock remains counted as a running request and only\nwakes when its file closes. Wake blocked locks during the drain without\nunpublishing or modifying their file objects. Synchronous CANCEL requests\nmust invoke their cancellation callback to wake pending operations, while\nCHANGE_NOTIFY completion remains specific to the asynchronous path.\n\nSerialize session teardown with channel registration and previous-session\ncleanup, and use atomic work-state transitions so LOGOFF, CANCEL, and\nconnection teardown invoke cancellation callbacks only once."
    }
  ],
  "lastModified": "2026-10-02T15:10:55.087",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72C40D03-D807-412F-8A03-2556A2D70DC5",
              "versionEndExcluding": "6.7",
              "versionStartIncluding": "6.6.48"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48B1FCEA-70A6-45BD-A39B-9184638703FB",
              "versionEndExcluding": "6.11",
              "versionStartIncluding": "6.10.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0CA0ED9-385D-45EA-A7C7-A31BCB9103B5",
              "versionEndExcluding": "7.2.7",
              "versionStartIncluding": "6.11.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4770BA57-3F3F-493B-8608-EC3B25254949"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE5298B3-04B4-4F3E-B186-01A58B5C75A6"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11E35E1B-5DB4-4AB9-9706-CD73B799EADF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}