CVE-2026-97556

Received Received - Intake

BaseFortify

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifs_sb_tlink() fails cifs_oplock_break() takes over the reference that cifs_queue_oplock_break() acquired when it queued the work, and drops it with _cifsFileInfo_put() once the break has been processed. Only in setups with "-o multiuser", cifs_sb_tlink() may fail, at which point cifs_oplock_break() returns without putting the file reference, mirroring the reference leak we already fixed in the companion patch to cifs_queue_oplock_break(). This would trigger a crash due to busy inodes on the next unmount: BUG: Dentry ... still in use (1) [unmount of cifs cifs] VFS: Busy inodes after unmount of cifs (cifs) Drop the reference on that path as well. Doing so before the out label mirrors the normal path, which also puts the reference before cifs_done_oplock_break(). Found by Sashiko code review. The failure path was not exercised at runtime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97556

EUVD

EUVD-2026-86864

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	5ee28bcfbaacf289eb25c662a2862542ea6ce6a7
Linux	Linux	e8f5f849ffce24490eb9449e98312b66c0dba76f
Linux	Linux	e8f5f849ffce24490eb9449e98312b66c0dba76f
Linux	Linux	e8f5f849ffce24490eb9449e98312b66c0dba76f
Linux	Linux	e8f5f849ffce24490eb9449e98312b66c0dba76f
Linux	Linux	e8f5f849ffce24490eb9449e98312b66c0dba76f
Linux	Linux	b99f490ea87ebcca3a429fd8837067feb56a4c7c
Linux	Linux	6b67a6d2e50634fe127e656147c81915955e9f5e
Linux	Linux	6.1.47
Linux	Linux	5.15.128
Linux	Linux	6.4.12
Linux	Linux	6.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a reference count leak in the SMB client when cifs_sb_tlink() fails. Specifically, cifs_oplock_break() does not release a file reference if cifs_sb_tlink() fails, which only occurs in setups using the 'multiuser' mount option. This can lead to a crash during unmount due to busy inodes.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS/SMB client implementation and may not have direct detection commands. Monitor kernel logs for errors like 'BUG: Dentry ... still in use' or 'Busy inodes after unmount of cifs' during unmount operations. Check if systems using CIFS with '-o multiuser' mount option experience crashes or hangs.

Impact Analysis

The impact includes system crashes when unmounting CIFS shares, particularly in multiuser setups. This could cause data corruption or denial of service if the system becomes unresponsive during critical operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it is a Linux kernel issue related to file reference leaks in the CIFS client. It may indirectly impact compliance if exploited to cause system instability or data corruption during unmount operations, potentially affecting data integrity or availability.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. If using CIFS with '-o multiuser', consider temporarily disabling this option until patched. Monitor system logs for related errors and update affected systems promptly.

Hi! I’m here to help you understand CVE-2026-97556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70