Cloudanix VulnDB

CVE-2026-98439

None

CVSS

—

EPSS

0.1%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux file-sharing code can let an attacker freeze the server by leaving unfinished requests hanging when a connection ends.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Pending asynchronous SMB requests prevent connection closure, causing the server to hang indefinitely while waiting for completion.

Why it matters to the business

SMB file-sharing services on Linux servers may become unresponsive, leading to temporary loss of network file access and potential resource exhaustion until the server is restarted.

How an attack unfolds

An attacker opens an SMB connection, issues async requests, then closes the connection; because requests are not canceled the server blocks on closure and remains unavailable.

How to fix it

Apply the upstream kernel patch that cancels active async requests before waiting for connection closure; rebuild and deploy the updated kernel on affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the smb/server connection-close code path for the added cancel logic and verify that connections terminate promptly after async requests are issued.

Typical attack path

  1. Establish an SMB session to the target server
  2. Submit one or more asynchronous requests
  3. Abruptly terminate the connection
  4. Observe the server thread blocked waiting for the uncanceled requests

How to detect it

Review SMB server logs and kernel traces for stalled connection-close operations or threads blocked on async request completion; correlate with high CPU or memory usage on SMB worker processes.

What your security team should do

  • Prioritize kernel updates for SMB servers given the recent publication date
  • Test the patched kernel in a staging environment to ensure SMB service stability
  • Monitor EPSS score for any upward trend that would increase exploitation likelihood

The record

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finish.

Affected packages

Ecosystem Package Introduced Fixed