SB2026102416 - Improper Enforcement of Behavioral Workflow in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-98901)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to compromise file cache consistency, potentially causing stale reads or file data corruption.

The vulnerability exists due to improper enforcement of lease state transitions in the Linux kernel ksmbd server when processing writes, truncates, and SMB2 lease break acknowledgments. A remote user can trigger incorrectly handled lease breaks and acknowledgments to leave caching states inconsistent with file operations, potentially causing stale reads or file data corruption.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/17699905a381621c1cee5b6528feb05acedc86a4
• https://git.kernel.org/stable/c/3251ea36df5eef58aa207fbee48849d89b922ea6
• https://git.kernel.org/stable/c/5015191096db311759fef98769270336cd8b1324
• https://git.kernel.org/stable/c/fba4653a0b4dc2f6d42600abe21fb326292f70ff