Live › vulnerability › CVE-2026-98452
Go to dashboardThe Linux kernel's SMB client (cifs/smb3) could keep a CREATE file handle open when a later command in the same compound request failed, and could trust a failed CREATE response. The sources do not describe a confirmed attacker path, so the practical impact is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that mount SMB/CIFS shares with the Linux kernel client, where directory caching is used against a server. Hosts that never mount SMB shares are not exposed. The sources do not state the exact trigger conditions.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the fix, see the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-98452lsmod | grep -E 'cifs|smb' or mount -t cifs,smb3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
smb: client: clean up failed cached directory opens
open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(). It also must not treat a response error as a valid CREATE.
Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from later compound commands. Move the -EREMCHG reconnect handling before response validation so a missing response does not hide the reconnect request. Count the handle when it is marked open; confirmed close responses decrement the counter, while existing close retry behavior remains best effort on transport failures.
This page as .md · .json · in your agent: get_signal("CVE-2026-98452")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.