A critical fix for the Linux kernel's in-kernel file server ksmbd never reached the 5.15 stable series, even though it was backported to every later long-term line. The flaw, CVE-2026-89788, is a use-after-free bug scored 9.8 that can be triggered without authentication by anyone able to reach the server.

The bug is in how ksmbd publishes a new tree connection: the connection can be left with a single reference while the handler is still initialising it and building a response, so a concurrent session logoff can free the object while it is still in use. According to a report on the stable kernel mailing list by Mohammed Omran, the fix landed upstream and appears in the 6.1, 6.6, 6.12 and 7.x stable releases, but the latest 5.15 release still does not contain it. Omran has asked the 5.15 maintainers to queue the missing backport.

The bug entered 5.15 with an earlier race-condition hardening change, first present in 5.15.145, so kernels before that point are not affected. It is a different flaw from the six ksmbd vulnerabilities published on 7 November, which are covered separately.

Most systems are not exposed: ksmbd is off by default in most distributions, Red Hat Enterprise Linux does not include it, and the module only listens once a userspace daemon starts it. Anyone running it should check with lsmod | grep ksmbd, keep port 445 off the internet, and watch for the 5.15 backport.