CVE-2026-98172 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g. kthread_create() returns an error), the error path frees tcp_ses without first destroying the smbd_connection.
Fix this by calling smbd_destroy() in the out_err cleanup path before kfree(tcp_ses). smbd_destroy() safely handles the case where smbd_conn is NULL, so it can be called unconditionally.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel's Common Internet File System (CIFS) client implementation contains a resource management flaw within its Remote Direct Memory Access RDMA subsystem that results in memory leaks under specific error conditions. This vulnerability arises from an imbalance in the cleanup logic during the initialization of TCP sessions for SMBD connections. Specifically, when establishing a connection via smbd_get_connection succeeds but subsequent steps such as creating kernel threads through kthread_create fail within cifs_get_tcp_session, the execution flow diverts to an error handling path that neglects to release previously allocated resources. This oversight leads to dangling pointers and unreleased memory structures that persist in system memory until the host is rebooted or the module is unloaded, contributing to gradual resource exhaustion over time.
From a technical perspective, the core issue lies in the order of operations within the error handling routine for cifs_get_tcp_session. The function successfully allocates and initializes an smbd_connection structure via smbd_get_connection but fails later when attempting to create necessary kernel threads required for RDMA communication. In this scenario, the code proceeds to free the tcp_ses structure using kfree without first invoking smbd_destroy on the associated connection object. This omission violates standard resource management practices where every successful allocation must have a corresponding deallocation in all exit paths including error branches. The fix addresses this by ensuring that smbd_destroy is called unconditionally before freeing the TCP session structure, thereby guaranteeing proper cleanup of RDMA-related resources regardless of whether thread creation succeeds or fails.
The operational impact of this vulnerability primarily manifests as memory leakage within kernel space which can degrade system performance and stability over extended periods of operation. While not directly exploitable for remote code execution or privilege escalation in the traditional sense, persistent resource leaks can lead to denial of service conditions by exhausting available kernel memory pools. This is particularly concerning in environments where CIFS clients are frequently instantiated and terminated such as containerized workloads or high-throughput file serving scenarios. Over time, these leaked smbd_connection structures accumulate potentially causing allocation failures for new connections and impacting overall network storage performance reliability.
This vulnerability aligns with CWE-401 which describes missing release of memory after effective usage leading to resource leaks. It also relates to improper cleanup procedures that fail to handle all execution paths correctly a common pattern in complex kernel subsystems involving multiple layers of abstraction like the CIFS RDMA integration. Security practitioners and system administrators should monitor for signs of increasing kernel memory consumption associated with network file systems particularly when using RDMA-enabled configurations. Mitigation involves applying vendor-provided patches that update the Linux kernel to include the corrected cleanup logic ensuring smbd_destroy is invoked in all error paths before resource deallocation occurs maintaining consistency between allocation and release operations throughout the lifecycle management of SMBD connections.