Cloudanix VulnDB

CVE-2026-98172

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux file-sharing code can waste memory during failed network connections, potentially causing slowdowns or crashes if many bad attempts occur.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Memory leak of smbd_connection structure in the Linux kernel CIFS client when RDMA connection via smbd_get_connection succeeds but cifs_get_tcp_session later fails, with tcp_ses freed without calling smbd_destroy in the error path.

Why it matters to the business

Repeated failed SMB/RDMA connection attempts can cause gradual kernel memory exhaustion on Linux systems, leading to performance degradation, resource contention, or crashes under sustained connection churn.

How an attack unfolds

An attacker triggers the error path by initiating RDMA SMB connections that succeed at the smbd layer but deliberately fail during subsequent kthread or session setup steps, leaking the smbd_connection each time without requiring authentication or data access.

How to fix it

Apply kernel updates containing the fix that unconditionally invokes smbd_destroy before kfree(tcp_ses) in the out_err path of cifs_get_tcp_session; rebuild and reboot affected systems.

How to confirm the fix worked

Inspect kernel source or running binary for the smbd_destroy call in the cifs_get_tcp_session error path; confirm absence of smbd_connection slab growth under synthetic connection-failure workloads.

Typical attack path

  1. Establish RDMA-capable network path to target Linux SMB client
  2. Force repeated calls to smbd_get_connection that succeed
  3. Induce failure in cifs_get_tcp_session (e.g., via resource pressure on kthread_create)
  4. Repeat to accumulate leaked smbd_connection objects until memory pressure occurs

How to detect it

Review kernel logs and dmesg for CIFS/RDMA session setup errors combined with unexplained growth in slab memory usage; correlate with process activity around cifs.ko or smbd-related symbols.

What your security team should do

  • Prioritize kernel updates on all Linux systems exposing CIFS/RDMA client functionality
  • Restrict outbound RDMA/SMB Direct traffic to trusted endpoints until patched
  • Monitor kernel slab allocator statistics for smbd_connection objects
  • Test connection failure paths in staging environments before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbd_connection leak on cifs_get_tcp_session() error When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g. kthread_create() returns an error), the error path frees tcp_ses without first destroying the smbd_connection. Fix this by calling smbd_destroy() in the out_err cleanup path before kfree(tcp_ses). smbd_destroy() safely handles the case where smbd_conn is NULL, so it can be called unconditionally.

Affected packages

Ecosystem Package Introduced Fixed