CVE-2026-97558
Received Received - Intake

Reference Leak in Linux Kernel SMB Client

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifs_close() defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2_deferred_work_close() drops one such reference. deferred_close_scheduled can be false while the work is pending: the workqueue clears PENDING when the callback starts to run, before the callback clears the flag under deferred_lock. A close in that interval requeues the running work, and the callback then clears the flag, leaving the requeued work pending with the flag down. A later cifs_open() can reuse the handle and its cifs_close() reaches the same branch: queue_delayed_work() fails because the work is still pending, but cifs_close() returns without dropping the closing file's reference. The cifsFileInfo count stays pinned and its tlink, dentry and server handle are leaked. Check the return value and hand off the reference only when work was actually queued. Otherwise, use the shared _cifsFileInfo_put(), like the mod_delayed_work() branch above: the pending execution already owns its reference. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97558
EUVD
EUVD-2026-86866

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference leak in the SMB client when closing files. When a close operation is deferred, the system fails to properly release a reference to the file's cifsFileInfo structure. This can lead to memory leaks where file handles, dentries, and server resources remain pinned even after the file is closed.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS/SMB client implementation and does not have a direct network or system detection method via standard commands. It requires kernel code analysis or static analysis tools to identify the reference leak in cifsFileInfo handling during deferred close operations.

Impact Analysis

This vulnerability can cause system resource exhaustion over time. It may lead to memory leaks, file handle exhaustion, and potential denial-of-service conditions if unclosed file references accumulate. Systems using SMB client functionality could experience performance degradation or crashes.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Monitor kernel updates from your distribution and upgrade to a patched version. No immediate workaround is suggested beyond patching, as the issue is resolved in the kernel code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97558. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart