Live › vulnerability › CVE-2026-98453
Go to dashboardWhen the Linux kernel's SMB2 client receives a malformed create-context block in a CREATE response, it returns an error without closing the remote handle it already opened. The server-side handle is left open and the client's open count stays inflated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel SMB client (cifs/smb3 mounts) against SMB servers. The flaw needs a server that returns malformed create-context data, so the risk sits with clients mounting untrusted or compromised shares. Hosts that do not mount SMB shares can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
smb: client: close handle after create-context parsing failure
SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle, leaving the server-side handle open and num_remote_opens elevated.
Close the handle after a post-CREATE context parsing failure so the error path releases the remote resource and balances the open count.
This page as .md · .json · in your agent: get_signal("CVE-2026-98453")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.