Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-98870

ksmbd: remove stale channels from all sessions on teardown

CVSS 8.8 HighEPSS 0.0054 · 45th percentile

Published by the CVE Program (CNA: Linux) at 23 Oct 2026, 11:37 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected b1b6ed903a6e2b3505a48706bcd499b447ef9e44 to before f8200bb4994e65a2e5c5b314789eeae39078619d git
  • affected 47b018dba6ec7ebf403fd2d1e713bc7acc9bbb23 to before 9cd6d714d3ca0cff296542dc989696884e41970f git
  • affected 9ef4dfd5edbd02f4bf10cd420a30896093d98a67 to before b145f9b56c87f9c23ad5464ab0844dbc1de12b36 git
  • affected 5a5b0b7a01fe19b383b3c046546b5ae30c1a7d71 to before a15cae16f4432a5ad919ee633e31b07178492955 git
  • affected faf8578c77f3d846aca9cd882c293e03eafcc6df to before b10665730fbf6b5e45fe422badcbbc3f0df96ef5 git
  • affected e632f21a8bc0c59abc4960482836ac3782db93c0 git
  • affected 5.15.222 to before 5.16 semver
Other versions: unaffected
Linux Linux No versions given Other versions: unaffected
Identifiers
CVE-2026-98870
CNA
Linux
Tags
Published
23 Oct 2026
Updated
24 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
8.8 High 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0054, the 45th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 23 Oct 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.