CVE-2026-89635
A flaw in the Linux kernel’s SMB server (ksmbd) can let a user cause the kernel to crash when two sessions use durable file handles and reconnect. The bug occurs when a reconnecting session inherits another session’s oplock, leading to a use‑after‑free that triggers a kernel panic. It affects any Linux system running the default ksmbd configuration.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Linux kernel, specifically the ksmbd SMB server component. Any system that enables durable handles and oplocks for SMB shares is potentially vulnerable.
Real-world impact
An attacker who can open a file with a durable handle in two separate sessions could force the kernel to crash, resulting in a denial‑of‑service. The crash occurs when the kernel dereferences a freed session pointer, causing a kernel panic.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no special privileges, and gives an attacker complete compromise of confidentiality, integrity, and availability. The lack of a user interface requirement and the high impact on all three core security dimensions make it critical.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources