CVE-2026-98112

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. Create the listener in a stopped state and hold an extra task_struct reference until kthread_stop_put() completes. Also stop and release listeners before freeing their interface records during TCP teardown.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: HIGH
CVSS score: 7.8 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 7.8 / 10 HIGH source: CNA overview
CWE(s): —
Reserved: 2026-09-25
Published: 2026-09-25 10:35 UTC
Last updated: 2026-09-25 14:42 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98112.json
Linked Threat: CVE-2026-98112 — ksmbd: fix listener task lifetime on netdev events

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-25 11:17:42 UTC
NVD last modified: 2026-09-25 15:18:06 UTC
NVD CVSS v3.1: 7.8 / 10 HIGH source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 5.9 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-86943
Assigner: Linux
Published: Sep 25, 2026, 10:35:59 AM
Updated: Sep 25, 2026, 2:42:06 PM
EUVD base score (CVSS 3.1): 7.8 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.1200
Vendors: Linux
Products: Linux (3316a8fc840d82fad5efcf76ad0ea3f76fdca209 <a506290f59e1c6ce9ac0a13158640bb8fee93471)

Linux (patch: 7.3-rc2)

Linux (6.19)

Linux (3316a8fc840d82fad5efcf76ad0ea3f76fdca209 <40581f10c1e56238b157af5f260b8f9518a0cbc1)

Linux (patch: 7.2.7)

Linux (patch: 0)
Aliases: GHSA-x6gr-8p6h-h2g7

ENISA description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. Create the listener in a stopped state and hold an extra task_struct reference until kthread_stop_put() completes. Also stop and release listeners before freeing their interface records during TCP teardown.

EUVD references (2)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`3316a8fc840d82fad5efcf76ad0ea3f76fdca209` (affected), `3316a8fc840d82fad5efcf76ad0ea3f76fdca209` (affected)	—
Linux	Linux	`6.19` (affected), `0` (unaffected), `7.2.7` (unaffected), `7.3-rc2` (unaffected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/40581f10c1e56238b157af5f260b8f9518a0cbc1 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a506290f59e1c6ce9ac0a13158640bb8fee93471 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft Update Catalog

web:catalog.update.microsoft.com

Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback

2026-09-27 22:54 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...

2026-09-27 22:54 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-27 22:54 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-27 22:54 UTC
August 11, 2026—Hotpatch KB5120994 (OS Builds 26200.9106 and 26100.9106 ...

web:support.microsoft.com

This Hotpatch update for Windows 11, version 25H2 and 24H2 (KB5120994) includes security improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates. To ...

2026-09-27 22:54 UTC
July 18, 2026—Hotpatch KB5121768 (OS Builds 26200.8893 and 26100.8893 ...

web:support.microsoft.com

This out-of-band (OOB) update for Windows 11, version 25H2 and Windows 11, version 24H2 (KB5121768) is cumulative. It includes all improvements from previous security and non-security updates, along with an additional fix . Improvements This OOB update includes the following improvement: [System Performance] This update addresses an issue affecting a limited number of devices with an Intel ...

2026-09-27 22:54 UTC
[Security Advisory] September 2026 CVE Advisory Notification

web:support.servicenow.com

What you need to know: On September 24, 2026 , ServiceNow issued CVE - 2026 -86857, CVE - 2026 -86858, CVE - 2026 -13016, CVE - 2026 -86859, and CVE - 2026 -86860. Each of these security issues was identified through internal security testing, customer security assessments, or reports submitted through ServiceNow's responsible disclosure and bug bounty programs and was remediated independently. For security ...

2026-09-27 22:54 UTC
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's September 2026 Patch Tuesday, with security updates released for a record-breaking 966 flaws, including two actively exploited zero-day vulnerabilities.

2026-09-27 22:54 UTC
Security Update Guide FAQs - microsoft.com

web:www.microsoft.com

These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.

2026-09-27 22:54 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-27 22:54 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-98112.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/transport_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40581f10c1e56238b157af5f260b8f9518a0cbc1",
              "status": "affected",
              "version": "3316a8fc840d82fad5efcf76ad0ea3f76fdca209",
              "versionType": "git"
            },
            {
              "lessThan": "a506290f59e1c6ce9ac0a13158640bb8fee93471",
              "status": "affected",
              "version": "3316a8fc840d82fad5efcf76ad0ea3f76fdca209",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/transport_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix listener task lifetime on netdev events\n\nThe listener thread exits when its listening socket is shutdown. The\nnetdevice notifier shuts down the socket before calling kthread_stop(), so\nthe task_struct can be freed before kthread_stop() gets its reference.\n\nCreate the listener in a stopped state and hold an extra task_struct\nreference until kthread_stop_put() completes. Also stop and release\nlisteners before freeing their interface records during TCP teardown."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is kthread_stop() on an already-exited listener, reached from ksmbd_netdev_event(NETDEV_DOWN). That event comes from local rtnetlink link up/down. No SMB message carries attacker data to this path, so it is not remote.\nAC:L - The attacker starts the race: kernel_sock_shutdown() makes the listener exit before kthread_stop() takes its reference. The attacker can repeat it at will by toggling a same-named link. Each NETDEV_UP makes create_socket() start a new listener, so the narrow window can be retried as many times as needed.\nPR:L - ksmbd_netdev_event() matches iface names without checking the network namespace. An unprivileged user in `unshare -Urn` can down their own `lo`, or a veth named like a host interface, with only CAP_NET_ADMIN inside the user namespace, and so run the teardown of the host listener.\nUI:N - Nothing is needed from an admin or victim beyond ksmbd already running. The attacker sends the netlink link up/down requests themselves inside their own network namespace.\nS:U - This is memory corruption inside the kernel that leads to local privilege escalation or a crash within the same kernel authority. It does not cross a hypervisor or other separate security boundary.\nC:H - After the listener task_struct is freed and reallocated, kthread_stop() reads to_kthread(k) and kthread->result through a dangling pointer. The attacker can control the reclaimed object, which enables kernel memory disclosure.\nI:H - kthread_stop() writes to freed memory: it increments the refcount, does set_bit() on kthread->flags, then calls wake_up_process() and put_task_struct() on the stale task. This corrupts whatever object has reclaimed the memory and can be groomed into a write or an extra free.\nA:H - Using the freed task_struct/kthread in kthread_stop() under rtnl can cause an oops, a refcount underflow or a hang. Each trigger also tears down ksmbd's real host listener on port 445, so the server stops accepting connections."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:42:06.515Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40581f10c1e56238b157af5f260b8f9518a0cbc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a506290f59e1c6ce9ac0a13158640bb8fee93471"
        }
      ],
      "title": "ksmbd: fix listener task lifetime on netdev events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98112",
    "datePublished": "2026-09-25T10:35:59.319Z",
    "dateReserved": "2026-09-25T10:25:14.316Z",
    "dateUpdated": "2026-09-25T14:42:06.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}