CVE-2026-97556 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: avoid leaking refcount when cifs_sb_tlink() fails
cifs_oplock_break() takes over the reference that cifs_queue_oplock_break() acquired when it queued the work, and drops it with _cifsFileInfo_put() once the break has been processed.
Only in setups with "-o multiuser", cifs_sb_tlink() may fail, at which point cifs_oplock_break() returns without putting the file reference, mirroring the reference leak we already fixed in the companion patch to cifs_queue_oplock_break().
This would trigger a crash due to busy inodes on the next unmount:
BUG: Dentry ... still in use (1) [unmount of cifs cifs]
VFS: Busy inodes after unmount of cifs (cifs)
Drop the reference on that path as well. Doing so before the out label mirrors the normal path, which also puts the reference before cifs_done_oplock_break().
Found by Sashiko code review. The failure path was not exercised at runtime.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel vulnerability identified in the Common Vulnerabilities and Exposures (CVE) database pertains to a reference count leak within the Server Message Block version 2 client implementation, specifically affecting the cifs_sb_tlink function during oplock break processing. This issue arises from an imbalance in how file structure references are managed when error conditions occur during the mounting or linking of superblock information for CIFS shares. The vulnerability is particularly relevant to configurations utilizing multi-user authentication modes, where specific code paths may fail due to resource constraints or configuration errors that prevent successful link establishment.
The technical flaw centers on the lifecycle management of file structure references in the cifs_oplock_break function. Under normal operational conditions, the cifs_queue_oplock_break function acquires a reference count for a file structure when it queues work items related to opportunistic lock breaks. Subsequently, the cifs_oplock_break function is responsible for taking over this reference and ensuring its release via _cifsFileInfo_put once the break operation has been successfully processed. However, in scenarios where multi-user authentication is enabled, the call to cifs_sb_tlink may fail. In such failure cases, the current implementation causes cifs_oplock_break to return early without releasing the acquired file reference. This behavior mirrors a previously identified leak in the companion patch for cifs_queue_oplock_break, indicating a systemic oversight in error path handling within this subsystem.
The operational impact of this vulnerability manifests as a resource leak that accumulates over time or under specific stress conditions involving multi-user mounts and oplock breaks. The immediate consequence is not necessarily an exploitable remote code execution but rather a stability issue leading to kernel crashes during unmount operations. Specifically, the unreleased reference prevents the inode from being properly cleaned up, resulting in busy inodes remaining after the file system has been unmounted. This triggers critical kernel debug messages such as BUG: Dentry still in use and VFS Busy inodes after unmount of cifs, which can lead to system instability or require a reboot to resolve the stuck state. While not directly exploitable for privilege escalation by an external attacker, this flaw degrades system reliability and availability, particularly in environments with frequent mount and unmount cycles involving multi-user CIFS shares.
From a classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after successful allocation or reference count leaks leading to resource exhaustion. It also relates to improper error handling practices that fail to clean up resources upon failure paths, often categorized under CWE-755 in contexts involving incorrect management of internal state variables like reference counts. The ATT&CK framework does not directly map this specific kernel bug to a tactical technique as it is an internal stability issue rather than an attack vector, but the underlying cause reflects weaknesses in secure coding practices regarding resource lifecycle management that could be exploited if combined with other vulnerabilities to induce denial-of-service conditions against critical system services.
Mitigation strategies primarily involve applying the upstream Linux kernel patches that address this reference count imbalance. System administrators should ensure their systems are updated with the latest stable kernel versions containing fixes for cifs_oplock_break error handling. For environments where multi-user authentication is not strictly required, disabling this feature can reduce exposure to the specific code path triggering the leak. Additionally, rigorous code review processes and static analysis tools that detect reference count mismatches in failure paths should be employed during development of kernel modules or drivers interacting with network file systems to prevent similar issues from being introduced into the codebase.