{"id":"CVE-2026-98449","kind":"vulnerability","aliases":["CVE-2026-98449"],"related":[],"title":"Linux kernel SMB client: double credit decrement on failed compound send","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: delete compound mids on send failure before unlock\n\nWhen sending a compound request fails, smb_send_rqst() kicks off a\nreconnect. compound_send_recv() still has those mids on pending_mid_q,\nbut it unlocks the server without removing them first.\n\nDuring reconnect, cifs_abort_connection() walks pending_mid_q and runs\neach mid callback. With no response yet, those callbacks return credits\nand drop in_flight. Then compound_send_recv()'s send-error path returns\nthe same credits again. in_flight ends up decremented twice and\nsmb2_add_credits() WARNs.\n\nsyzbot hits this during SMB2_negotiate when the socket send fails.\n\ncifs_call_async() already calls delete_mid() before unlock on send\nfailure. Do the same for compound chains and set cancelled_mid[] so the\nout: path does not delete them again.","summary":"When a compound SMB request fails to send, the Linux kernel's CIFS client leaves its request entries queued while reconnecting, so credits are returned twice. The result is a kernel warning (WARN) during SMB2 negotiation, which the sources describe as hit by syzbot.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","kernel","linux","runtime","smb"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:16:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:25+00:00","updated_at":"2026-10-25T05:27:25+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:27:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel SMB client: double credit decrement on failed compound send","impact":"low","summary":"When a compound SMB request fails to send, the Linux kernel's CIFS client leaves its request entries queued while reconnecting, so credits are returned twice. The result is a kernel warning (WARN) during SMB2 negotiation, which the sources describe as hit by syzbot.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","smb","cifs"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel WARN triggered during SMB negotiation; impact beyond that unknown","analyst_note":"Check the upstream kernel stable commit that fixes this and whether the WARN can be escalated beyond a kernel warning; sources give no fixed kernel version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000539,"input_tokens":3517,"output_tokens":375,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98449':14A,17A 'abort':123C 'add':168C 'alreadi':185C 'async':184C 'call':183C,186C 'callback':133C,139C 'cancel':202C 'chain':199C 'cif':18B,35B,122C,182C 'client':4A,36B,78C 'compound':10A,25B,80C,90C,100C,147C,198C 'connect':124C 'credit':6A,45B,141C,158C,169C 'cve':12A,15A 'decrement':7A,164C 'delet':79C,187C,210C 'describ':62B 'doubl':5A 'drop':143C 'end':162C 'entri':40B 'error':153C 'fail':9A,28B,92C,181C 'failur':84C,193C 'first':119C 'flight':145C,161C 'follow':72C 'hit':64B,172C 'kernel':2A,19B,33B,53B,70C 'kick':96C 'leav':37B 'linux':1A,20B,32B,69C 'mid':81C,106C,109C,127C,132C,188C,203C 'negoti':58B,176C 'path':154C,207C 'pend':108C,126C 'q':110C,128C 'queu':41B 'reconnect':43B,99C,121C 'recv':102C,149C 'remov':117C 'request':27B,39B,91C 'resolv':76C 'respons':136C 'result':50B 'return':47B,140C,155C 'rqst':95C 'run':130C 'runtim':21B 'send':11A,30B,83C,88C,94C,101C,148C,152C,180C,192C 'send-error':151C 'server':115C 'set':201C 'smb':3A,22B,26B,77C,93C 'smb2':57B,167C,175C 'socket':179C 'sourc':61B 'still':103C 'syzbot':66B,171C 'twice':48B,165C 'unlock':86C,113C,190C 'vulner':73C 'walk':125C 'warn':54B,55B,170C 'without':116C 'yet':137C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98449","severity":null,"published_at":"2026-10-18T16:16:55+00:00","modified_at":"2026-10-19T10:18:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}