Critical ksmbd UAF fix missing from Linux 5.15 stable
CVE-2026-89788 scored 9.8 and reached later longterm kernels, but 5.15 still lacks the September 2026 tree-connection fix.
A critical use-after-free fix for the in-kernel SMB server ksmbd never reached the Linux 5.15 stable series, even though maintainers backported it to every later longterm line.
Mohammed Omran reported on the stable kernel list that the change closing CVE-2026-89788 landed upstream in September 2026 and appears in the 6.1, 6.6, 6.12, and 7.x stable releases. The latest 5.15 release still does not contain it. According to the CVE affected table, the bug entered 5.15 with an earlier race-condition hardening (first present in 5.15.145); kernels before that point are not affected.
In plain terms, the tree-connection publish path could leave a newly created connection with only a single reference while the SMB tree-connect handler continued to initialize it and build a response. A concurrent session logoff could drop that reference and free the object under active use. The issue carries a CVSS score of 9.8.
Omran asked 5.15 maintainers to queue the missing backport.