Cloudanix VulnDB

CVE-2026-98897

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent Linux kernel fix prevents file-sharing slowdowns that could occur when certain client connections conflict, so organizations should update their systems to keep network file access responsive.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in ksmbd where ci->m_lock is held during wait_for_break_ack() for up to 35s while a conflicting close path needs the write lock, resulting in deadlock until timeout and degraded lease handling performance.

Why it matters to the business

Linux SMB servers may experience prolonged delays or temporary unresponsiveness on file operations when clients use deferred lease closes, increasing latency for connected systems and potentially affecting workloads that rely on timely SMB access; low immediate risk given recent publication and minimal exploit probability.

How an attack unfolds

An attacker with network access to an SMB share triggers a sequence of conflicting opens and deferred closes on a file with active read-handle leases, forcing the server thread to block on the held lock until the timeout expires and causing extended stalls without requiring authentication or code execution.

How to fix it

Apply the upstream Linux kernel patch that collects target opinfos under the lock then performs lease breaks after releasing it; rebuild and deploy the updated kernel, ensuring OPLOCK_CLOSING state checks remain intact.

How to confirm the fix worked

Confirm kernel source contains the revised __smb_break_all_levII_oplock and parent lease paths that drop ci->m_lock before waiting; re-run xfstests generic/001 with leases enabled and verify completion time returns to baseline of approximately 4 seconds.

Typical attack path

  1. Establish SMB connection and obtain read-handle lease via deferred close
  2. Issue conflicting open request to initiate lease break
  3. Server enters wait_for_break_ack while holding read lock on ci->m_lock
  4. Client close path attempts write lock and blocks, extending operation to full 35s timeout
  5. Attacker repeats to sustain resource contention and latency

How to detect it

Inspect kernel logs and SMB audit trails for repeated OPLOCK_WAIT_TIME expirations or extended stalls in ksmbd lease break paths; correlate with client close operations on files using read-handle leases.

What your security team should do

  • Prioritize kernel upgrade on all exposed SMB servers within normal change windows given low EPSS and absence from KEV
  • Monitor for sustained high-latency SMB operations coinciding with lease-enabled clients
  • Test patched kernels in staging with lease-heavy workloads before production rollout
  • Review downstream package updates as ecosystem dependents become available

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko client caches a read-handle (RH) lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in wait_for_break_ack() for up to OPLOCK_WAIT_TIME (35s). __smb_break_all_levII_oplock() runs that wait while holding ci->m_lock for read. cifs.ko reacts to a handle-lease break by closing the deferred handle rather than sending a lease break acknowledgment. That close path (close_id_del_oplock() -> opinfo_del()) takes ci->m_lock for write and is exactly what would wake the waiter, but it blocks on the read lock held by the waiting thread. The break is then resolved only by the 35s timeout, so xfstests generic/001 takes ~78s with leases enabled versus ~4s with oplocks only. Collect the target opinfos (each pinned with a reference) while holding ci->m_lock, then break them after releasing it, matching how smb_grant_oplock() already breaks a conflicting lease using only a reference. The reference keeps the opinfo (and its conn and lease) alive across the unlocked window, and a close racing the break is handled by the existing OPLOCK_CLOSING state check. Apply the same fix to the parent lease break paths.

Affected packages

Ecosystem Package Introduced Fixed