{"id":"CVE-2026-98452","kind":"vulnerability","aliases":["CVE-2026-98452"],"related":[],"title":"Linux kernel SMB client: failed cached directory opens leak handles and mishandle responses","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clean up failed cached directory opens\n\nopen_cached_dir() sends CREATE and QUERY_INFO as a compound request. If\nthe CREATE succeeds but a later command returns an error, the function\nmust retain the CREATE FID so common cleanup can issue SMB2_close(). It\nalso must not treat a response error as a valid CREATE.\n\nValidate the CREATE response before using its fields, record the FIDs, and\nmark the handle open before handling errors from later compound commands.\nMove the -EREMCHG reconnect handling before response validation so a\nmissing response does not hide the reconnect request. Count the handle\nwhen it is marked open; confirmed close responses decrement the counter,\nwhile existing close retry behavior remains best effort on transport\nfailures.","summary":"The Linux kernel's SMB client (cifs/smb3) could keep a CREATE file handle open when a later command in the same compound request failed, and could trust a failed CREATE response. The sources do not describe a confirmed attacker path, so the practical impact is unknown.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","linux-kernel","runtime","smb-client"],"not_affected_if":["no-smb-mounts"],"how_to_check":"- Run `uname -r` and compare against the kernel version that carries the fix, see the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-98452\n- Check whether the SMB client is in use with `lsmod | grep -E 'cifs|smb'` or `mount -t cifs,smb3`","fix":"- Update the Linux kernel to a release that includes the upstream commit for CVE-2026-98452; the fixed version is unknown in the sources\n- Until patched, avoid mounting untrusted SMB shares","status":"open","published_at":"2026-10-18T16:16:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:23+00:00","updated_at":"2026-10-25T05:27:23+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:27:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit for CVE-2026-98452; the fixed version is unknown in the sources\n- Until patched, avoid mounting untrusted SMB shares","reach":"network","title":"Linux kernel SMB client: failed cached directory opens leak handles and mishandle responses","impact":"medium","summary":"The Linux kernel's SMB client (cifs/smb3) could keep a CREATE file handle open when a later command in the same compound request failed, and could trust a failed CREATE response. The sources do not describe a confirmed attacker path, so the practical impact is unknown.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","smb-client","cifs"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the attacker outcome","analyst_note":"Confirm the fixed kernel versions and whether the flaw is remotely triggerable from a malicious SMB server, using the NVD entry and the linked kernel.org commits.","how_to_check":"- Run `uname -r` and compare against the kernel version that carries the fix, see the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-98452\n- Check whether the SMB client is in use with `lsmod | grep -E 'cifs|smb'` or `mount -t cifs,smb3`","needs_analyst":true,"not_affected_if":["no-smb-mounts"],"who_is_affected":"Systems that mount SMB/CIFS shares with the Linux kernel client, where directory caching is used against a server. Hosts that never mount SMB shares are not exposed. The sources do not state the exact trigger conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":3477,"output_tokens":630,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98452':16A,19A 'also':130C 'attack':66B 'behavior':200C 'best':202C 'cach':6A,89C,93C 'cif':20B 'cifs/smb3':34B 'clean':86C 'cleanup':124C 'client':4A,27B,33B,85C 'close':128C,191C,198C 'command':45B,111C,163C 'common':123C 'compound':49B,102C,162C 'confirm':65B,190C 'could':35B,53B 'count':182C 'counter':195C 'creat':38B,57B,96C,106C,120C,140C,143C 'cve':14A,17A 'decrement':193C 'describ':63B 'dir':94C 'directori':7A,90C 'effort':203C 'eremchg':166C 'error':114C,136C,159C 'exist':197C 'fail':5A,51B,56B,88C 'failur':206C 'fid':121C,151C 'field':148C 'file':39B 'follow':79C 'function':116C 'handl':10A,40B,155C,158C,168C,184C 'hide':178C 'impact':71B 'info':99C 'issu':126C 'keep':36B 'kernel':2A,23B,30B,77C 'later':44B,110C,161C 'leak':9A 'linux':1A,22B,29B,76C 'linux-kernel':21B 'mark':153C,188C 'mishandl':12A 'miss':174C 'move':164C 'must':117C,131C 'open':8A,41B,91C,92C,156C,189C 'path':67B 'practic':70B 'queri':98C 'reconnect':167C,180C 'record':149C 'remain':201C 'request':50B,103C,181C 'resolv':83C 'respons':13A,58B,135C,144C,170C,175C,192C 'retain':118C 'retri':199C 'return':112C 'runtim':24B 'send':95C 'smb':3A,26B,32B,84C 'smb-client':25B 'smb2':127C 'sourc':60B 'succeed':107C 'transport':205C 'treat':133C 'trust':54B 'unknown':73B 'use':146C 'valid':139C,141C,171C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Systems that mount SMB/CIFS shares with the Linux kernel client, where directory caching is used against a server. Hosts that never mount SMB shares are not exposed. The sources do not state the exact trigger conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98452","severity":null,"published_at":"2026-10-18T16:16:55+00:00","modified_at":"2026-10-19T10:18:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}