CVE-2026-98112: ksmbd: fix listener task lifetime on netdev events
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix listener task lifetime on netdev events
The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthreadstop(), so the taskstruct can be freed before kthreadstop() gets its reference.
Create the listener in a stopped state and hold an extra taskstruct reference until kthreadstopput() completes. Also stop and release listeners before freeing their interface records during TCP teardown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
For ksmbd listener lifetime handling, create the listener in a stopped state, hold an extra task_struct reference until kthread_stop_put() completes, and stop and release listeners before freeing their interface records during TCP teardown.
Event History
Frequently Asked Questions
When can this issue be triggered?
It can be triggered during network-device events or TCP teardown involving ksmbd listeners. The problematic sequence occurs when a listener socket is shut down and its listener thread exits before the notifier calls kthread_stop().
What is the underlying failure condition?
The listener task_struct may be freed before kthread_stop() obtains its reference. The fix keeps an additional task_struct reference until kthread_stop_put() completes and releases listeners before their interface records are freed during TCP teardown.