{"id":"CVE-2026-98453","kind":"vulnerability","aliases":["CVE-2026-98453"],"related":[],"title":"Linux kernel SMB client leaks server handle when create-context parsing fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: close handle after create-context parsing failure\n\nSMB2_open() accounts a successful CREATE response as a remote open before\nparsing its create contexts.  If smb2_parse_contexts() rejects malformed\ncontext data, SMB2_open() returns without closing the handle, leaving the\nserver-side handle open and num_remote_opens elevated.\n\nClose the handle after a post-CREATE context parsing failure so the error\npath releases the remote resource and balances the open count.","summary":"When the Linux kernel's SMB2 client receives a malformed create-context block in a CREATE response, it returns an error without closing the remote handle it already opened. The server-side handle is left open and the client's open count stays inflated.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","linux-kernel","runtime","smb-client"],"not_affected_if":["no-smb-mounts"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the commit closing the handle after create-context parsing failure; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-18T16:16:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:22+00:00","updated_at":"2026-10-25T05:27:22+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:27:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the commit closing the handle after create-context parsing failure; the exact fixed version is unknown from the sources.","reach":"network","title":"Linux kernel SMB client leaks server handle when create-context parsing fails","impact":"low","summary":"When the Linux kernel's SMB2 client receives a malformed create-context block in a CREATE response, it returns an error without closing the remote handle it already opened. The server-side handle is left open and the client's open count stays inflated.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","smb-client","cifs"],"confidence":0.5,"needs_auth":"unknown","worst_case":"server-side handle leaks; resource exhaustion on the SMB server","analyst_note":"Check the kernel commit and stable backport list for the fixed kernel versions and confirm the reach from the NVD entry.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-smb-mounts"],"who_is_affected":"Systems running the Linux kernel SMB client (cifs/smb3 mounts) against SMB servers. The flaw needs a server that returns malformed create-context data, so the risk sits with clients mounting untrusted or compromised shares. Hosts that do not mount SMB shares can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000584,"input_tokens":3383,"output_tokens":491,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98453':16A,19A 'account':96C 'alreadi':56B 'balanc':157C 'block':41B 'cif':20B 'client':4A,27B,34B,68B,85C 'close':51B,86C,122C,137C 'context':11A,40B,91C,109C,113C,116C,145C 'count':71B,160C 'creat':10A,39B,44B,90C,99C,108C,144C 'create-context':9A,38B,89C 'cve':14A,17A 'data':117C 'elev':136C 'error':49B,150C 'fail':13A 'failur':93C,147C 'follow':79C 'handl':7A,54B,62B,87C,124C,130C,139C 'inflat':73B 'kernel':2A,23B,31B,77C 'leak':5A 'leav':125C 'left':64B 'linux':1A,22B,30B,76C 'linux-kernel':21B 'malform':37B,115C 'num':133C 'open':57B,65B,70B,95C,104C,119C,131C,135C,159C 'pars':12A,92C,106C,112C,146C 'path':151C 'post':143C 'post-creat':142C 'receiv':35B 'reject':114C 'releas':152C 'remot':53B,103C,134C,154C 'resolv':83C 'resourc':155C 'respons':45B,100C 'return':47B,120C 'runtim':24B 'server':6A,60B,128C 'server-sid':59B,127C 'side':61B,129C 'smb':3A,26B,84C 'smb-client':25B 'smb2':33B,94C,111C,118C 'stay':72B 'success':98C 'vulner':80C 'without':50B,121C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel SMB client (cifs/smb3 mounts) against SMB servers. The flaw needs a server that returns malformed create-context data, so the risk sits with clients mounting untrusted or compromised shares. Hosts that do not mount SMB shares can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98453","severity":null,"published_at":"2026-10-18T16:16:55+00:00","modified_at":"2026-10-21T13:21:30+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}