CVE-2026-98452 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: clean up failed cached directory opens
open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(). It also must not treat a response error as a valid CREATE.
Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from later compound commands. Move the -EREMCHG reconnect handling before response validation so a missing response does not hide the reconnect request. Count the handle when it is marked open; confirmed close responses decrement the counter, while existing close retry behavior remains best effort on transport failures.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel SMB client implementation contained a logic flaw in the directory caching mechanism that could lead to resource leaks and improper state management during compound request processing. The function responsible for opening cached directories, open_cached_dir(), constructs a compound SMB2 packet containing both CREATE and QUERY_INFO commands. This design is intended to optimize network performance by reducing round-trip latency; however, it introduced a critical vulnerability where the handling of partial failures was insufficiently robust. Specifically, when the initial CREATE command succeeded but a subsequent command within the same compound request returned an error, the code failed to properly retain and manage the File Identifier (FID) associated with the successful creation. This oversight meant that the common cleanup routines were not invoked to issue the necessary SMB2_close() call for that specific handle, resulting in a server-side resource leak where file handles remained open on the remote share despite the client-side operation failing or being incomplete.
This vulnerability falls under CWE-401, which describes missing release of memory after successful allocation, and more specifically relates to improper cleanup procedures during error handling paths. In the context of network protocols like SMB2/SMB3, failure to close file handles can lead to exhaustion of server-side resources such as open file descriptors or session slots. Over time, repeated occurrences of this issue could degrade the performance of the SMB share or cause connection resets for other clients accessing the same resource. Furthermore, by not validating the CREATE response before utilizing its fields, the code risked using uninitialized or invalid data structures if the server returned an error status immediately after the CREATE command, potentially leading to undefined behavior in subsequent operations that rely on these cached directory handles.
The remediation involves a rigorous restructuring of the open_cached_dir() function logic to ensure strict adherence to protocol state machines and resource lifecycle management. The fix mandates validating the response from the CREATE command before any fields are utilized or recorded as valid file identifiers. This ensures that only successfully created files have their FIDs tracked for eventual closure. Additionally, the handle is now explicitly marked as open only after successful validation, and a counter is incremented to track active handles. When close responses are confirmed, this counter is decremented, providing accurate accounting of resource usage. The reconnect handling logic for -EREMCHG errors was also moved prior to response validation to prevent scenarios where missing server responses might inadvertently suppress necessary reconnection attempts, thereby improving the resilience of the client against transient network issues or server-side state mismatches.
From a defensive perspective, this update aligns with best practices outlined in ATT&CK technique T1071, Application Layer Protocol, specifically regarding SMB/DFS traffic management where proper session and file handle hygiene is critical for maintaining availability. Administrators should ensure that the Linux kernel on affected systems is updated to include these patches. For environments relying heavily on network shares, monitoring server-side open file counts can serve as an indicator of whether such resource leaks were being exploited or occurring due to unpatched software versions. The fix emphasizes the importance of validating every step in a compound request and ensuring that cleanup routines are executed regardless of which specific command within the sequence fails, thereby maintaining system stability and preventing long-term degradation of network storage services.