Cloudanix VulnDB

CVE-2026-98681

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in how Linux handles certain internal flags while talking to Windows file shares can cause files to appear wrongly open or deleted, leading to errors or crashes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Concurrent updates to multiple flags in the same bitfield byte of struct cifsFileInfo generate unprotected byte-level RMW operations, allowing one flag write to corrupt another.

Why it matters to the business

May cause file handle corruption, incorrect oplock handling, or deleted-file status errors during multi-threaded SMB client activity, potentially leading to data access failures or application crashes on Linux systems using CIFS.

How an attack unfolds

An attacker triggers simultaneous code paths that modify different flags in the shared bitfield (for example by opening files, triggering oplock breaks, and deleting files concurrently) so that one RMW overwrites another, resulting in inconsistent state.

How to fix it

Upgrade the Linux kernel to a version containing the fix that replaces the shared bitfield with separate bool fields in struct cifsFileInfo.

How to confirm the fix worked

Inspect the cifsFileInfo structure definition in the kernel source for separate bool members instead of a single bitfield; verify the change is present in the running kernel via /proc or kernel debug symbols.

Typical attack path

  1. Mount a remote SMB share from a Linux client
  2. Initiate concurrent file operations that touch invalidHandle, oplock_break_cancelled, and status_file_deleted
  3. Race the bitfield updates across different lock domains
  4. Observe corrupted flag values leading to incorrect handle or cache behavior

How to detect it

Review kernel logs and SMB client traces for unexpected handle invalidation or oplock state mismatches during high-concurrency file activity; no public exploitation artifacts are known.

What your security team should do

  • Prioritize kernel updates on all Linux systems acting as SMB/CIFS clients
  • Monitor upstream stable kernel releases for the backported fix
  • Limit concurrent SMB operations from the same client process until patched

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplock_break_cancelled, offload, and status_file_deleted fields are stored in the same bitfield byte in struct cifsFileInfo, but are updated in different code paths that may run simultaneously, and are protected by different locks. Since bitfield assignments generate byte-level read-modify-write operations, a modification to one flag can overwrite a concurrent modification to another flag. To avoid these races, convert these flags from a bitfield to separate bool fields.

Affected packages

Ecosystem Package Introduced Fixed