CVE-2026-98449 Overview
CVE-2026-98449 is a Linux kernel vulnerability in the SMB client (smb/client) code path handling compound request send failures. When smb_send_rqst() fails to transmit a compound Server Message Block (SMB) request, the function triggers a reconnect while leaving multiple message IDs (mids) queued on pending_mid_q and unlocks the server without removing them. The subsequent reconnect path and the send-error path both return credits for the same mids, decrementing in_flight twice and triggering a WARN in smb2_add_credits(). The flaw was reproduced by syzbot during SMB2_negotiate when the socket send fails.
Critical Impact
Local or network-adjacent conditions that cause SMB send failures can trigger kernel warnings and credit accounting corruption in the CIFS/SMB client, potentially leading to denial of service.
Affected Products
- Linux kernel SMB/CIFS client (fs/smb/client)
- Systems using the in-kernel SMB2/SMB3 client to mount remote shares
- Distributions shipping affected mainline kernel revisions prior to the referenced stable commits
Discovery Timeline
- 2026-10-18 - CVE-2026-98449 published to the National Vulnerability Database (NVD)
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98449
Vulnerability Analysis
The defect lives in the compound request handling path of the Linux kernel SMB client. When compound_send_recv() dispatches a chain of SMB requests through smb_send_rqst() and transmission fails, the function initiates a reconnect but leaves the chain's mids queued on pending_mid_q. The server lock is released before cleanup completes.
During reconnect, cifs_abort_connection() walks pending_mid_q and invokes each mid callback. Because no response was received, those callbacks return credits to the session and decrement in_flight. The send-error path in compound_send_recv() then returns the same credits again. The duplicated accounting causes in_flight to be decremented twice, which trips a WARN_ON inside smb2_add_credits(). Syzbot reproduced the condition during SMB2_negotiate when the underlying socket send operation failed.
The class of defect is a race condition and resource accounting error [CWE-662 / CWE-911] in kernel credit management. The result is noisy kernel warnings, corrupted SMB credit state, and potential denial of service on affected mounts.
Root Cause
cifs_call_async() already calls delete_mid() before releasing the server lock on send failure. The compound send path did not mirror this behavior. Mids remained reachable to the reconnect abort logic while the error path still believed it owned them, producing a double credit return.
Attack Vector
Exploitation requires conditions that cause SMB socket send failures while a compound request is in flight. A malicious or unstable SMB server, intentional network disruption during negotiation, or syzkaller-style fuzzing of the SMB client interface can all trigger the race. The vulnerability is reachable from any workload that mounts SMB shares on a vulnerable kernel.
No verified exploit code is public. See the kernel commit references for technical patch details: Kernel Git Commit 70783946 and Kernel Git Commit 8f6f8a48.
Detection Methods for CVE-2026-98449
Indicators of Compromise
- Kernel WARN traces originating in smb2_add_credits() with references to in_flight underflow
- Repeated SMB reconnect events on hosts mounting remote shares, correlated with SMB2_negotiate failures
- dmesg entries referencing compound_send_recv, smb_send_rqst, or cifs_abort_connection
Detection Strategies
- Collect kernel ring buffer output and alert on WARN or WARNING frames in fs/smb/client modules
- Monitor SMB client reconnect rates and credit accounting anomalies through kernel tracing or ftrace
- Correlate socket send errors on SMB sessions with subsequent kernel warnings to identify triggering servers
Monitoring Recommendations
- Forward /var/log/kern.log and journald kernel events to a centralized logging or SIEM platform for pattern detection
- Track CIFS statistics in /proc/fs/cifs/Stats for abnormal reconnect counts and failed negotiations
- Baseline SMB mount stability per host and alert on sudden spikes in abort or reconnect operations
How to Mitigate CVE-2026-98449
Immediate Actions Required
- Apply the upstream kernel fix referenced in commits 70783946 and 8f6f8a48 or update to a stable kernel release containing both
- Inventory Linux systems using the in-kernel CIFS/SMB client and prioritize patching for servers mounting untrusted or unstable SMB endpoints
- Restrict SMB client connectivity to trusted file servers until patches are deployed
Patch Information
The fix mirrors the behavior of cifs_call_async() by calling delete_mid() on the compound chain before unlocking the server on send failure. It also sets cancelled_mid[] so the out path does not attempt to delete the same mids again. Patch details are available in Kernel Git Commit 70783946 and Kernel Git Commit 8f6f8a48.
Workarounds
- Avoid mounting SMB shares from untrusted or unreliable servers until the kernel is patched
- Where feasible, substitute SMB mounts with alternative protocols such as NFS on affected hosts
- Harden network paths to SMB servers to minimize transient send failures that can trigger the race
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
