CVE-2026-68312: Linux Kernel Information Disclosure Bug

CVE-2026-68312 Overview

CVE-2026-68312 is a memory leak vulnerability in the Linux kernel's Common Internet File System (CIFS) client. The flaw resides in the deferred close drain paths, specifically in cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry(). When cancel_delayed_work() succeeds but a subsequent kmalloc_obj() allocation fails under memory pressure, the cifsFileInfo reference and the open server handle both leak. The kernel maintainers have merged a fix that captures the failed allocation target and releases it after unlocking.

Critical Impact
Repeated leaks under sustained memory pressure exhaust kernel object slabs and leave stale server-side file handles open, degrading CIFS/SMB client stability.

Affected Products

Linux kernel CIFS client (fs/smb/client)
Systems mounting SMB/CIFS shares using the affected kernel versions
Stable kernel branches referenced by commits 32390b3f06f2 and c2f2e83e3bbc

Discovery Timeline

2026-08-10 - CVE-2026-68312 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68312

Vulnerability Analysis

The vulnerability is a kernel memory leak in the CIFS client deferred close subsystem. When the client attempts to drain pending deferred closes, it iterates over cfile entries, cancels their delayed work with cancel_delayed_work(), and then attempts to add each entry to a local processing list via kmalloc_obj(). Under memory pressure, this allocation can fail. The original code responded to the allocation failure by breaking out of the loop immediately.

Breaking the loop leaves the cancelled cfile in an inconsistent state. The delayed work that would normally have invoked _cifsFileInfo_put() has already been cancelled and will not run. The entry never reaches file_head for later processing. As a result, the cifsFileInfo reference count is never decremented, and the associated open handle on the SMB server is never released.

Root Cause

The root cause is missing cleanup on the allocation-failure path. Cancelling delayed work transfers responsibility for releasing the reference to the caller, but the failure path did not honor that contract. This is a classic Memory Leak defect combined with an error-handling omission in a resource ownership transfer.

Attack Vector

The vulnerability requires the CIFS client to execute deferred close drain paths under memory pressure. It is not a remotely triggerable code execution primitive. Sustained workloads that repeatedly open and close files on SMB shares while the system experiences memory constraints can accumulate leaked cifsFileInfo objects and orphan server-side handles. This degrades client stability and can contribute to denial of service on long-running CIFS-heavy systems.

The upstream fix saves the cfile whose allocation failed into a local variable, breaks out of the loop as before, and calls _cifsFileInfo_put() on it after releasing the lock. Files later in the iteration remain unaffected because their deferred work is still pending and will complete normally. See the Kernel Git Commit Reference and the Kernel Git Commit Update for the patch details.

Detection Methods for CVE-2026-68312

Indicators of Compromise

Growing slab allocations for cifs_file_info_cache reported by /proc/slabinfo on systems mounting SMB shares.
Stale open file handles on SMB servers that outlive the client processes that opened them.
Kernel warnings or allocation failures originating from CIFS deferred close paths during memory pressure events.

Detection Strategies

Track kernel version and patch level across the fleet and flag hosts running unpatched CIFS clients that mount SMB shares.
Correlate SMB server session tables against expected client activity to identify orphaned handles.
Monitor dmesg for kmalloc failures inside fs/smb/client call paths.

Monitoring Recommendations

Baseline the memory footprint of CIFS-related slab caches and alert on sustained growth.
Log CIFS mount and unmount events, along with kernel version metadata, to a centralized platform for retention and query.
Review SMB server-side open-file counts on a scheduled cadence to detect long-lived handles from patched-out client versions.

How to Mitigate CVE-2026-68312

Immediate Actions Required

Identify all Linux hosts that mount SMB/CIFS shares and inventory their kernel versions.
Schedule updates to a kernel build containing commits 32390b3f06f2 and c2f2e83e3bbc.
Prioritize systems that experience frequent memory pressure or maintain large numbers of concurrent SMB file handles.

Patch Information

The fix is upstream in the Linux kernel via commits 32390b3f06f26e366cfb27dbac4bc0196c321535 and c2f2e83e3bbc5483730fd4ee903182761f1ae50f. Apply the vendor-supplied kernel update from your distribution once it incorporates these commits into the relevant stable branch.

Workarounds

Reduce sustained memory pressure on CIFS clients by right-sizing workloads and tuning vm.min_free_kbytes where appropriate.
Limit reliance on deferred close semantics by mounting with tuned closetimeo values so fewer entries accumulate in the deferred queue.
Reboot long-running CIFS clients periodically until the patched kernel is deployed to reclaim any leaked references.

bash

# Verify running kernel version and check for the fix
uname -r

# Example: query slab usage for CIFS file info objects
grep -E 'cifs_file_info|cifs_inode' /proc/slabinfo

# Example: reduce deferred close window on a CIFS mount
mount -t cifs //server/share /mnt/share -o closetimeo=1,vers=3.1.1