CVE-2026-98112: ksmbd: fix listener task lifetime on netdev events
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix listener task lifetime on netdev events
The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthreadstop(), so the taskstruct can be freed before kthreadstop() gets its reference.
Create the listener in a stopped state and hold an extra taskstruct reference until kthreadstopput() completes. Also stop and release listeners before freeing their interface records during TCP teardown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Create the listener in a stopped state and hold an extra task_struct reference until kthread_stop_put() completes, preventing the task_struct from being freed before kthread_stop() obtains its reference during netdevice-triggered TCP teardown.
Event History
Frequently Asked Questions
When can this issue be triggered?
It can be triggered during network-device events or TCP teardown involving ksmbd listeners. The problematic sequence occurs when a listener socket is shut down and its listener thread exits before the notifier calls kthread_stop().
What is the underlying failure condition?
The listener task_struct may be freed before kthread_stop() obtains its reference. The fix keeps an additional task_struct reference until kthread_stop_put() completes and releases listeners before their interface records are freed during TCP teardown.