Cloudanix VulnDB

CVE-2026-98449

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux file-sharing code can mishandle internal counters when network sends fail, causing warnings that may affect stability.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in Linux kernel SMB client compound request handling causes in_flight credits to be decremented twice on send failure during reconnect, triggering smb2_add_credits warnings and credit accounting errors.

Why it matters to the business

SMB client connections may log warnings or experience instability during network disruptions, increasing operational overhead and risk of file-sharing service interruptions in Linux environments.

How an attack unfolds

An attacker or network condition triggers a socket send failure on an SMB2 compound request such as negotiate; the code path fails to remove mids from pending_mid_q before unlock, allowing cifs_abort_connection to process them and double-return credits.

How to fix it

Update to a Linux kernel containing the fix that calls delete_mid on compound mids before unlock on send failure and sets cancelled_mid to prevent duplicate deletion.

How to confirm the fix worked

Confirm kernel source contains the compound_send_recv changes, reproduce send-failure path without warnings, and verify in_flight accounting remains consistent.

Typical attack path

  1. Establish SMB2 session to target Linux client
  2. Induce or wait for send failure on compound request
  3. Trigger reconnect path that walks pending_mid_q
  4. Observe double credit decrement and kernel warnings

How to detect it

Review kernel logs on Linux SMB clients for repeated smb2_add_credits warnings coinciding with connection resets or send failures; examine dmesg and audit logs around SMB2_negotiate events.

What your security team should do

  • Prioritize kernel updates for systems using SMB client
  • Monitor kernel logs for smb2_add_credits warnings on SMB hosts
  • Test SMB connectivity under simulated network loss after patching

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server without removing them first. During reconnect, cifs_abort_connection() walks pending_mid_q and runs each mid callback. With no response yet, those callbacks return credits and drop in_flight. Then compound_send_recv()'s send-error path returns the same credits again. in_flight ends up decremented twice and smb2_add_credits() WARNs. syzbot hits this during SMB2_negotiate when the socket send fails. cifs_call_async() already calls delete_mid() before unlock on send failure. Do the same for compound chains and set cancelled_mid[] so the out: path does not delete them again.

Affected packages

Ecosystem Package Introduced Fixed