CVE-2026-98453: Linux Kernel SMB Client Privilege Escalation

CVE-2026-98453 Overview

CVE-2026-98453 is a resource management flaw in the Linux kernel's SMB client code. The SMB2_open() function accounts a successful CREATE response as a remote open before parsing its create contexts. When smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle. This leaves the server-side handle open and the num_remote_opens counter elevated.

The issue affects Linux kernel versions that include the SMB client with create-context parsing. The upstream fix closes the handle after a post-CREATE context parsing failure, releasing the remote resource and balancing the open count.

Critical Impact
A malicious or malformed SMB server response can cause the Linux SMB client to leak remote file handles and skew internal open-handle accounting, leading to resource exhaustion on both client and server.

Affected Products

Linux kernel SMB client (fs/smb/client)
Distributions shipping kernels prior to the fix commits referenced below
Systems mounting remote shares via the SMB2/SMB3 protocol

Discovery Timeline

2026-10-18 - CVE-2026-98453 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98453

Vulnerability Analysis

The vulnerability resides in the SMB2 client open path. SMB2_open() issues an SMB2 CREATE request to a remote server, and on a successful response increments the num_remote_opens statistic to track the newly opened handle. The function then calls smb2_parse_contexts() to validate the create-context data returned by the server.

When smb2_parse_contexts() detects malformed context data, it returns an error. The original code propagates this error back to the caller without issuing a corresponding SMB2 CLOSE for the handle just created. The remote handle remains allocated on the server, and the client's num_remote_opens counter is never decremented.

Repeated triggering of this error path drains server-side handle limits and distorts client-side telemetry used for connection management. On busy SMB mounts, this can degrade service availability for other clients and processes.

Root Cause

The root cause is an incomplete error-handling path in SMB2_open(). The function treats CREATE success and context parsing as independent steps, but fails to roll back the CREATE when context parsing rejects the response. This is a resource leak pattern classified as a missing release of resource after an effective lifetime.

Attack Vector

Exploitation requires a malicious or compromised SMB server, or a server that returns malformed create-context data due to a bug. A Linux client mounting such a share and performing open operations will leak server-side handles on each failed parse. The attack is local to the SMB session and does not require authentication beyond what the mount already provides. See the upstream commits 566820af, 80c67cc7, cdb36b09, eaa97a19, and f09875ff for the fix details.

Detection Methods for CVE-2026-98453

Indicators of Compromise

Steadily increasing num_remote_opens counter on SMB client mounts without matching close activity
SMB server logs showing growing counts of open file handles attributed to a specific Linux client
Repeated SMB2 CREATE responses followed by context-parsing errors in kernel logs (dmesg)
Mount points returning EMFILE or similar resource exhaustion errors on open operations

Detection Strategies

Monitor /proc/fs/cifs/Stats and related debug interfaces for anomalous open-handle growth
Correlate kernel ring buffer messages referencing smb2_parse_contexts failures with SMB session metadata
Baseline normal SMB open/close ratios per mount and alert on sustained divergence

Monitoring Recommendations

Collect kernel logs from Linux endpoints that mount SMB shares and forward them to a central log store
Track SMB server-side open-handle counts per client IP to catch leaked handles early
Alert when a client's open count exceeds historical maxima without corresponding user activity

How to Mitigate CVE-2026-98453

Immediate Actions Required

Inventory Linux systems that mount SMB/CIFS shares and record their kernel versions
Apply the vendor kernel update that includes the referenced upstream fix commits
Restrict SMB mounts to trusted servers until patches are deployed
Reboot affected hosts after kernel installation to activate the fix

Patch Information

The fix is available upstream in the Linux kernel stable tree. Relevant commits include 566820af, 80c67cc7, cdb36b09, eaa97a19, and f09875ff. Distribution maintainers backport these commits into supported kernel branches; consult your distribution's security advisory for the specific package version containing the fix.

Workarounds

Unmount SMB shares from untrusted or unmaintained servers
Limit which users and processes can trigger SMB open operations on shared mounts
Periodically remount affected SMB shares to reset leaked server-side handles until patching is complete

bash

# Verify running kernel and check for the SMB client module
uname -r
modinfo cifs | grep -E 'filename|version'

# Inspect current SMB client statistics for anomalous open counts
cat /proc/fs/cifs/Stats

# Remount an affected share to clear leaked handles (service impact)
umount /mnt/share && mount -a