VulnerabilityPublished 25 Sep 2026Updated 30 Oct 2026

CVE-2026-97558: Linux kernel · smb: client: fix cifsFileInfo reference leak in deferred close

Source GCVE Database

Compare

Authoritative record:CVE-2026-97558· Low

Not known to be exploited · fixed in ea93759d6c2789924f4e557aed5be532207715ea : update Linux kernel when convenient.

Data as of 30 Oct 2026, 17:48 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in ea93759d6c2789924f4e557aed5be532207715ea, bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6, a6767712902beb0f53238be485971c9a83ea1079 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-25h5-cphg-25gg

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ c3f207ab29f793b8c942ce8067ed123f18d5b81b, < ea93759d6c2789924f4e557aed5be532207715ea	Fixed in ea93759d6c2789924f4e557aed5be532207715ea
LinuxLinux	Affected ≥ c3f207ab29f793b8c942ce8067ed123f18d5b81b, < bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6	Fixed in bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6
LinuxLinux	Affected ≥ c3f207ab29f793b8c942ce8067ed123f18d5b81b, < a6767712902beb0f53238be485971c9a83ea1079	Fixed in a6767712902beb0f53238be485971c9a83ea1079
LinuxLinux	Affected ≥ c3f207ab29f793b8c942ce8067ed123f18d5b81b, < 5520e89a5a4f834bced64cf2ac927001cc513a40	Fixed in 5520e89a5a4f834bced64cf2ac927001cc513a40
LinuxLinux	Affected ≥ c3f207ab29f793b8c942ce8067ed123f18d5b81b, < 645a7359c1f740152464edf84f1030e0cad42c9d	Fixed in 645a7359c1f740152464edf84f1030e0cad42c9d
LinuxLinux	Affected ≥ c3f207ab29f793b8c942ce8067ed123f18d5b81b, < 525c225e23d61694091f2806de553a69362a78ff	Fixed in 525c225e23d61694091f2806de553a69362a78ff

AI-suggested

A fix has been implemented in the Linux kernel to address this reference leak by properly handling the deferred close workqueue references. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation.

Description

A reference leak vulnerability in the Linux kernel's SMB client implementation was fixed. The issue occurs when cifs_close() defers closing a file, potentially leaking references to cifsFileInfo structures due to improper handling of workqueue flags. This can cause resource leaks related to file handles and server connections.

Impact

The vulnerability causes a resource leak in the Linux kernel SMB client, specifically leaking references to file information structures and associated server handles. This can lead to increased memory usage and potentially degrade system stability over time but does not directly indicate privilege escalation or remote code execution.

Summary

The vulnerability in the Linux kernel's SMB client involves a reference leak of cifsFileInfo structures during deferred file close operations. When cifs_close() defers a close, it transfers the cifsFileInfo reference to queued work. Due to a race condition with the deferred_close_scheduled flag and workqueue state, a close operation can requeue work without properly dropping the reference, leading to a leak of cifsFileInfo count, tlink, dentry, and server handle. The fix involves checking the return value of queue_delayed_work() and only handing off the reference if the work was actually queued; otherwise, it uses a shared reference drop function to avoid leaks. This issue was identified using an in-house static analysis tool.

References

Community reviews

Loading reviews…