All vulnerabilities
CVE-2026-98449

Linux: smb: client: delete compound mids on send failure before unlock

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in70783946f3b5d0c06ec7df0f5e7bec2bfad24efbAlso 8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9, 4.21CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 70783946f3b5d0c06ec7df0f5e7bec2bfad24efbLinuxCVE List
  • 8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9LinuxCVE List
  • 4.21LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: delete compound mids on send failure before unlock

When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server without removing them first.

During reconnect, cifs_abort_connection() walks pending_mid_q and runs each mid callback. With no response yet, those callbacks return credits and drop in_flight. Then compound_send_recv()'s send-error path returns the same credits again. in_flight ends up decremented twice and smb2_add_credits() WARNs.

syzbot hits this during SMB2_negotiate when the socket send fails.

cifs_call_async() already calls delete_mid() before unlock on send failure. Do the same for compound chains and set cancelled_mid[] so the out: path does not delete them again.

Text from CVE List

Affected versions 8

  • Linuxaffected: ee258d79159afed52ca9372aeb9c1a51e89b32ee before 70783946f3b5d0c06ec7df0f5e7bec2bfad24efbCVE List
  • Linuxaffected: ee258d79159afed52ca9372aeb9c1a51e89b32ee before 8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9CVE List
  • Linuxaffected: 3c57a0be487088b08d9c88998f911eb4a7ba36e4CVE List
  • Linuxaffected: 4.20.11 before 4.21CVE List
  • Linuxaffected: 5.0CVE List
  • Linuxunaffected: all versions before 5.0CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2