CVE-2026-98452
NoneCVSS
—
EPSS
0.2%
Published
Oct 18, 2026
CISA due date
—
Cloudanix analysis
A recent fix addresses a bug in Linux that could cause problems when opening folders on network file shares if responses arrive in an unexpected order.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Improper validation of CREATE responses in compound SMB requests allows use of invalid FIDs or mishandled errors after partial success in open_cached_dir(), with incorrect ordering of reconnect handling and handle reference counting.
Why it matters to the business
Recent Linux kernel SMB clients may experience crashes, failed directory operations, or resource leaks when accessing network shares under error conditions, increasing operational risk for file-sharing workloads.
How an attack unfolds
An attacker positions a malicious or faulty SMB server to return a successful CREATE followed by an error on QUERY_INFO in a compound request; without response validation the client uses uninitialized FIDs or skips cleanup, and mishandled -EREMCHG reconnects can be masked.
How to fix it
Update the Linux kernel to a version containing the fix that validates CREATE responses before use, records FIDs, marks handles open only after validation, and moves -EREMCHG handling earlier; rebuild and reboot affected systems.
How to confirm the fix worked
Verify the presence of the upstream commit that adds CREATE response validation and correct FID recording; test SMB cached directory opens under injected error conditions and confirm handle counters increment and decrement correctly.
Typical attack path
- Initiate cached directory open via compound CREATE+QUERY_INFO
- Return crafted response with CREATE success and later error
- Trigger client use of unvalidated FID fields or missed reconnect
- Cause reference count imbalance or invalid handle close
How to detect it
Search kernel logs and audit trails for SMB2 CREATE/QUERY_INFO compound failures, -EREMCHG messages preceding response processing, or unbalanced handle open/close events around cached directory operations.
What your security team should do
- Apply kernel updates within standard change windows given low EPSS and absence from KEV
- Monitor kernel SMB logs for compound request errors
- Limit exposure by restricting SMB client access to trusted servers until patched
The record
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(). It also must not treat a response error as a valid CREATE. Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from later compound commands. Move the -EREMCHG reconnect handling before response validation so a missing response does not hide the reconnect request. Count the handle when it is marked open; confirmed close responses decrement the counter, while existing close retry behavior remains best effort on transport failures.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|