CVE-2026-98450: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-98450 Overview

CVE-2026-98450 is a Linux kernel vulnerability in the SMB client code path handling compound requests. The flaw resides in compound_send_recv(), which waits for responses in order. When a later wait is interrupted or a later MID (Message Identifier) fails during response synchronization, an earlier CREATE operation may have already opened a remote handle. The earlier MID is then released without invoking handle_cancelled_mid(), leaving the remote handle open on the server because no File Identifier (FID) was returned to the caller. The result is a resource leak of remote file handles against the SMB server.

Critical Impact
Interrupted or failed compound SMB operations can leak remote file handles on the server, leading to resource exhaustion and potential denial-of-service conditions over time.

Affected Products

Linux kernel SMB client (fs/smb/client)
Kernel builds containing the vulnerable compound_send_recv() logic prior to the referenced stable commits
Distributions shipping unpatched Linux kernels with CIFS/SMB2 client support

Discovery Timeline

2026-10-18 - CVE-2026-98450 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98450

Vulnerability Analysis

The Linux kernel SMB client issues compound requests, bundling multiple SMB2 operations such as CREATE, QUERY_INFO, and CLOSE into a single network round trip. The helper compound_send_recv() processes responses sequentially. If synchronization of a later MID aborts, earlier successful operations are not inspected before their response buffers are released.

When the earlier operation is an SMB2 CREATE that already opened a remote handle, the client discards the response without extracting the returned FID. Because the FID never reaches the caller, no code path can later issue an SMB2 CLOSE for that handle. The server continues to track the open file, consuming session and handle resources until the session is torn down.

The fix marks completed earlier MIDs as cancelled when a compound wait or MID synchronization aborts. Response buffers remain attached while MIDs are synchronized and are transferred only after processed responses complete synchronization. This allows the release path to inspect successful CREATE responses and queue an SMB2_close() after a later failure. The patch also accounts for the remote open only after the close work is allocated and before it is queued, and marks the create+close compound used by smb2_unlink() so it is not closed again.

Root Cause

The root cause is incorrect error handling in a compound-request state machine. Successful partial results were released without reconciling the on-wire state, producing an orphaned remote resource. This is a file system vulnerability in the kernel SMB client.

Attack Vector

Exploitation requires a scenario in which compound SMB operations are interrupted or a later MID in a compound fails. Attackers controlling an SMB server or disrupting network paths to an SMB server can trigger repeated partial failures, accumulating leaked handles on the server and consuming resources available to legitimate clients. No verified public exploit is available. See the referenced kernel commits for technical details.

Detection Methods for CVE-2026-98450

Indicators of Compromise

Growing counts of orphaned SMB2 open handles on file servers without matching client close operations
Elevated cifs or smb3 client errors in dmesg correlated with signal interruptions during file I/O
Session resource exhaustion warnings from SMB servers interacting with Linux clients

Detection Strategies

Monitor Linux kernel versions on fleet endpoints and compare against the fixed stable kernel builds listed in the referenced git commits
Correlate SMB server-side open-handle counts with client-side file descriptor accounting to identify divergence
Track interrupted syscalls (EINTR) on SMB-backed mounts to identify conditions that can trigger the leak

Monitoring Recommendations

Instrument SMB server telemetry to alert on anomalous handle growth per client principal
Collect kernel logs centrally and alert on cifs subsystem warnings related to compound requests
Validate patch deployment status across Linux hosts and flag kernels missing the fix commits

How to Mitigate CVE-2026-98450

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable git commits to all affected Linux systems
Prioritize patching Linux hosts that mount SMB/CIFS shares, especially long-lived mounts under heavy use
Restart SMB client sessions after patching to clear any pre-existing leaked handles on the server

Patch Information

Fixes have been merged into the Linux stable tree. Review the following commits for the authoritative patch content: Kernel Git Commit 224b56b, Kernel Git Commit 2536124, Kernel Git Commit 2cb07d1, Kernel Git Commit 6c5c547, and Kernel Git Commit 8afc801. Rebuild and deploy kernels incorporating these changes.

Workarounds

No vendor-published workaround replaces the patch; apply the fix as soon as a maintained kernel build is available
Reduce exposure by avoiding interruption of SMB-bound processes and by stabilizing network paths to SMB servers
Periodically unmount and remount SMB shares to force session teardown and release of leaked server-side handles

bash

# Verify running kernel version and confirm the fix is applied
uname -r
# Example: check your distribution advisory for the backported commit hash
# then upgrade via your package manager, for example on Debian/Ubuntu:
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot