HIGH Introduced in 6.19
ksmbd Listener UAF
CVE-2026-98112
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. Create the listener in a stopped state and hold an extra task_struct reference until kthread_stop_put() completes. Also stop and release listeners before freeing their interface records during TCP teardown.
02KernelScan AI Analysis
Risk summary
A use-after-free in the ksmbd in-kernel SMB server occurs when a network interface goes down. The listener thread can exit and free its task structure before the teardown code finishes referencing it, leading to kernel memory corruption. An attacker who can trigger network interface state changes on a system running ksmbd could exploit this to crash the kernel or escalate privileges.
Vulnerability analysis
When a network interface goes down, the ksmbd server's cleanup path shuts down the listening socket before stopping the listener thread. Because shutting down the socket makes the listener exit immediately, the thread's kernel object can be freed while the cleanup code is still using it, causing a use-after-free. The fix ensures the listener is created in a way that keeps its kernel object alive until cleanup explicitly finishes with it, and centralizes the teardown order so listeners are stopped before their interface records are freed. This vulnerability is reachable on systems where the ksmbd SMB server is active, and can be triggered by a local actor who can cause a network interface state change, typically requiring CAP_NET_ADMIN or access to a privileged network management service.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.19 | 7.2.7 | 40581f10c1e5 |
| mainline | 6.19 | 7.3 | a506290f59e1 |