CVE-2026-97557
Received Received - Intake

Reference Leak in Linux Kernel CIFS Client

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifs_queue_oplock_break() cifs_queue_oplock_break() unconditionally takes a reference on the target file before queueing cifs_oplock_break(). Only that work item decreases the reference counter again. If another oplock break arrives while that work is still queued, queue_work() will return false and not queue this second work item. As a result, we will never reach the point to drop the file reference again and are leaking this reference. This can be triggered when interacting with a slow-responding server. As a result, later unmount operations for this file system will fail with BUG: Dentry ... still in use (1) [unmount of cifs cifs] VFS: Busy inodes after unmount of cifs (cifs) kernel BUG at fs/super.c:777! Fix this by only incrementing the reference count if the work has been queued successfully. Taking it after queue_work() is safe because all three callers hold tcon->open_file_lock across the call and _cifsFileInfo_put() decrements under that same lock, so a worker that starts the handler in the window cannot drop the reference before it has been taken.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97557
EUVD
EUVD-2026-86865

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the SMB client where cifs_queue_oplock_break() incorrectly increments a file reference count without properly decrementing it. If an oplock break is queued while a previous one is still processing, the second operation fails to queue, leaving the reference count elevated. This causes file system unmounts to fail with kernel errors due to busy inodes.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS/SMB client implementation and may not have direct detection commands. Monitor kernel logs for errors like 'BUG: Dentry ... still in use (1)' or 'Busy inodes after unmount of cifs' during unmount operations. Check for failed unmounts of CIFS shares.

Impact Analysis

If exploited, this flaw could lead to system instability during file operations with SMB shares. The primary impact is failed unmounts of CIFS file systems, which may cause kernel panics or require a system reboot to recover. It could also result in resource leaks affecting system performance over time.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this issue. Avoid using CIFS shares with slow-responding servers until patched. Monitor system logs for related errors and consider temporarily disabling CIFS oplock features if immediate patching is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97557. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart