SMB2 Session Management Flaw in Linux Kernel by Linux Foundation

CVE-2026-98420

What is CVE-2026-98420?

A flaw in the Linux kernel related to the ksmbd module has been identified, affecting how SMB2 sessions are managed. The issue incorrectly treats session idle time as session expiration, leading to unexpected session terminations. When a client initiates a new SessionSetup exchange, valid sessions may be erroneously destroyed after ten seconds of inactivity. This can confuse session timelines and cause disruptions, such as failures in mapped drives due to invalidated connections. The vulnerability highlights the need for periodic expiration checks while also ensuring that active sessions remain protected against premature expiration. The implementation should align with Windows-compatible timing to maintain functional connectivity.

References