CVE-2026-98449
Received Received - Intake

smb: client: Use-after-free in compound request handling

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server without removing them first. During reconnect, cifs_abort_connection() walks pending_mid_q and runs each mid callback. With no response yet, those callbacks return credits and drop in_flight. Then compound_send_recv()'s send-error path returns the same credits again. in_flight ends up decremented twice and smb2_add_credits() WARNs. syzbot hits this during SMB2_negotiate when the socket send fails. cifs_call_async() already calls delete_mid() before unlock on send failure. Do the same for compound chains and set cancelled_mid[] so the out: path does not delete them again.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98449
EUVD
EUVD-2026-103689

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux ee258d79159afed52ca9372aeb9c1a51e89b32ee
Linux Linux ee258d79159afed52ca9372aeb9c1a51e89b32ee
Linux Linux 3c57a0be487088b08d9c88998f911eb4a7ba36e4
Linux Linux 4.20.11
Linux Linux 5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the SMB client where sending a compound request fails. The issue occurs when the system attempts to reconnect without properly cleaning up pending requests, leading to a double decrement of in_flight credits and a warning in smb2_add_credits().

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and may not have direct detection commands. Monitor kernel logs for WARN messages related to smb2_add_credits() or in_flight counter mismatches during SMB operations. Check for failed SMB compound requests or reconnection events in system logs.

Impact Analysis

This could cause system instability or crashes during SMB operations, particularly when network issues occur. It may lead to data corruption or denial of service if the kernel triggers warnings or panics.

Mitigation Strategies

Update the Linux kernel to the latest patched version that resolves this issue. If immediate patching is not possible, avoid using SMB compound requests or disable SMBv2/3 features temporarily until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98449. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart