All vulnerabilities
CVE-2026-98172

Linux: smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3164402c58940ff58a3cecdb026405f07b0253afAlso 5c908e49d349266dff0c86dda6a05df0ff19b824, 928edc4bd6a617caabeb575fc13c254d9df623c4CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3164402c58940ff58a3cecdb026405f07b0253afLinuxCVE List
  • 5c908e49d349266dff0c86dda6a05df0ff19b824LinuxCVE List
  • 928edc4bd6a617caabeb575fc13c254d9df623c4LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g. kthread_create() returns an error), the error path frees tcp_ses without first destroying the smbd_connection.

Fix this by calling smbd_destroy() in the out_err cleanup path before kfree(tcp_ses). smbd_destroy() safely handles the case where smbd_conn is NULL, so it can be called unconditionally.

Text from CVE List

Affected versions 14

  • Linuxaffected: 2f8946464b11822169b9f10c7cf58a2440b51d54 before 3164402c58940ff58a3cecdb026405f07b0253afCVE List
  • Linuxaffected: 2f8946464b11822169b9f10c7cf58a2440b51d54 before e3344bb0ff5ec8a276f42239e140f5442841ef23CVE List
  • Linuxaffected: 2f8946464b11822169b9f10c7cf58a2440b51d54 before 5c908e49d349266dff0c86dda6a05df0ff19b824CVE List
  • Linuxaffected: 2f8946464b11822169b9f10c7cf58a2440b51d54 before 928edc4bd6a617caabeb575fc13c254d9df623c4CVE List
  • Linuxaffected: 2f8946464b11822169b9f10c7cf58a2440b51d54 before b26a3fcf2f1c2cadba400290b639f01395db8fc8CVE List
  • Linuxaffected: 2f8946464b11822169b9f10c7cf58a2440b51d54 before e75c96157d45e498970158c8f7373d90102e33b9CVE List
  • Linuxaffected: 4.16CVE List
  • Linuxunaffected: all versions before 4.16CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6