FKIE_CVE-2026-98172

Vulnerability from fkie_nvd - Published: 2026-10-06 09:17 - Updated: 2026-10-19 10:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbd_connection leak on cifs_get_tcp_session() error When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g. kthread_create() returns an error), the error path frees tcp_ses without first destroying the smbd_connection. Fix this by calling smbd_destroy() in the out_err cleanup path before kfree(tcp_ses). smbd_destroy() safely handles the case where smbd_conn is NULL, so it can be called unconditionally.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3164402c58940ff58a3cecdb026405f07b0253af
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5c908e49d349266dff0c86dda6a05df0ff19b824
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/928edc4bd6a617caabeb575fc13c254d9df623c4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b26a3fcf2f1c2cadba400290b639f01395db8fc8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e3344bb0ff5ec8a276f42239e140f5442841ef23
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e75c96157d45e498970158c8f7373d90102e33b9
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3164402c58940ff58a3cecdb026405f07b0253af",
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "versionType": "git"
            },
            {
              "lessThan": "e3344bb0ff5ec8a276f42239e140f5442841ef23",
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "versionType": "git"
            },
            {
              "lessThan": "5c908e49d349266dff0c86dda6a05df0ff19b824",
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "versionType": "git"
            },
            {
              "lessThan": "928edc4bd6a617caabeb575fc13c254d9df623c4",
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "versionType": "git"
            },
            {
              "lessThan": "b26a3fcf2f1c2cadba400290b639f01395db8fc8",
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "versionType": "git"
            },
            {
              "lessThan": "e75c96157d45e498970158c8f7373d90102e33b9",
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbd_connection leak on cifs_get_tcp_session() error\n\nWhen an RDMA connection is successfully established via\nsmbd_get_connection() but cifs_get_tcp_session() later fails (e.g.\nkthread_create() returns an error), the error path frees tcp_ses\nwithout first destroying the smbd_connection.\n\nFix this by calling smbd_destroy() in the out_err cleanup path before\nkfree(tcp_ses).  smbd_destroy() safely handles the case where\nsmbd_conn is NULL, so it can be called unconditionally."
    }
  ],
  "id": "CVE-2026-98172",
  "lastModified": "2026-10-19T10:18:17.507",
  "metrics": {},
  "published": "2026-10-06T09:17:58.920",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3164402c58940ff58a3cecdb026405f07b0253af"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5c908e49d349266dff0c86dda6a05df0ff19b824"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/928edc4bd6a617caabeb575fc13c254d9df623c4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b26a3fcf2f1c2cadba400290b639f01395db8fc8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e3344bb0ff5ec8a276f42239e140f5442841ef23"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e75c96157d45e498970158c8f7373d90102e33b9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.