CVE-2026-98450

Received Received - Intake

Linux Kernel SMB Client Handle Leak Vulnerability

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle. The earlier mid is then released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller. Mark completed earlier mids as cancelled when a compound wait or MID synchronization aborts. Keep their response buffers attached while the MIDs are synchronized, and transfer them only after synchronization of the processed responses, so the release path can inspect successful CREATE responses and queue SMB2_close() after a later failure. Account for a remote open only after the close work is allocated and before it is queued, since the caller has not yet updated num_remote_opens. Mark the create+close compound used by smb2_unlink() so it is not closed again. Non-CREATE responses and compounds that already include a close keep their existing behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98450

EUVD

EUVD-2026-103690

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	e0bba0b8548179b696e86c158ea8f45f2ef6ad14
Linux	Linux	e0bba0b8548179b696e86c158ea8f45f2ef6ad14
Linux	Linux	e0bba0b8548179b696e86c158ea8f45f2ef6ad14
Linux	Linux	e0bba0b8548179b696e86c158ea8f45f2ef6ad14
Linux	Linux	4.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the SMB client handling compound requests. When a later part of a compound request fails during synchronization, an earlier CREATE operation may have already opened a remote handle. The system then releases the earlier operation without properly closing the remote handle, leaving it open indefinitely.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and requires kernel-level inspection. Detection involves checking for unclosed SMB handles due to failed compound requests. Commands like dmesg, journalctl, or kernel logs may show errors related to SMB operations. Network monitoring tools like Wireshark could capture SMB traffic for anomalies in compound request handling.

Impact Analysis

This could allow unauthorized access to remote files or resources due to lingering open handles. It may lead to data leaks, unauthorized modifications, or denial of service if handles are not properly closed.

Compliance Impact

This vulnerability involves improper handling of remote file handles in the Linux kernel's SMB client, potentially leading to unauthorized access or data leakage. While not explicitly tied to GDPR or HIPAA, such issues could violate principles of data protection and confidentiality required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches to address the smb client vulnerability. Monitor SMB connections for unexpected remote handles left open after compound operations. Ensure smb2_unlink() and similar operations are properly handling create+close compounds to avoid double-closing.

Hi! I’m here to help you understand CVE-2026-98450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70