CVE-2026-98452
Received Received - Intake

SMB Client Directory Open Failure in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(). It also must not treat a response error as a valid CREATE. Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from later compound commands. Move the -EREMCHG reconnect handling before response validation so a missing response does not hide the reconnect request. Count the handle when it is marked open; confirmed close responses decrement the counter, while existing close retry behavior remains best effort on transport failures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98452
EUVD
EUVD-2026-103692

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux b0f6df737a1c5d9d5ff90cc946205d8af46cc067
Linux Linux b0f6df737a1c5d9d5ff90cc946205d8af46cc067
Linux Linux b0f6df737a1c5d9d5ff90cc946205d8af46cc067
Linux Linux b0f6df737a1c5d9d5ff90cc946205d8af46cc067
Linux Linux 5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of SMB (Server Message Block) directory operations. When a cached directory open fails, the system may not properly clean up resources, leading to potential resource leaks or incorrect state management in the SMB client.

Impact Analysis

This vulnerability could allow attackers to cause denial-of-service conditions, corrupt data, or trigger unexpected behavior in systems using the Linux kernel's SMB client functionality. It may lead to system instability or crashes during SMB operations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart