CVE-2026-23230

What it actually does

Concurrent updates to is_open, has_lease and on_list flags stored in the same bitfield byte of struct cached_fid generate byte read-modify-write operations; an interleaving can cause one CPU's update to restore stale values of the other flags.

Why it matters to the business

SMB client file-handle and lease state can become inconsistent, risking data corruption, leaked file access, or unexpected connection failures on systems using the affected kernel code paths.

How an attack unfolds

An attacker with network access to an SMB server triggers parallel client operations that update the cached_fid bitfield from different CPUs; the resulting RMW race leaves one or more flags in an incorrect state, allowing the attacker to manipulate open/lease semantics.

How to fix it

Upgrade every listed package on Red Hat Enterprise Linux 8.4 AUS to the exact fixed version supplied for that package (for example postgresql-server to 0:13.23-1.module+el8.4.0+23703+6d959a24 and pgaudit to 0:1.5.0-1.module+el8.4.0+8873+b821c30a).

How to confirm the fix worked

Verify installed package versions match or exceed the fixed versions; confirm the kernel no longer uses a single-byte bitfield for the three cached_fid flags by inspecting source or running targeted concurrency tests.

Typical attack path

1. Establish concurrent SMB sessions or file operations from the client
2. Force the kernel to load the shared bitfield byte on one CPU
3. Clear or modify flags on a second CPU
4. Complete the RMW store on the first CPU to reintroduce stale bits
5. Abuse resulting inconsistent handle or lease state

How to detect it

Search kernel and SMB client logs for unexpected handle or lease state transitions; examine crash dumps or tracepoints around cached_fid updates for evidence of concurrent bitfield modifications.

What your security team should do

• Apply the listed package updates immediately on all RHEL 8.4 AUS systems
• Monitor EPSS trend and re-evaluate if exploit maturity changes
• Add the race-condition pattern to internal kernel code-review checklists