In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends… (CVE-2026-98452)

The vulnerability in the Linux kernel SMB client concerned the open_cached_dir() function, which sends CREATE and QUERY_INFO commands as a compound request. If the CREATE command succeeded but a later command failed, the function previously did not correctly retain the CREATE FID, potentially causing improper cleanup. The patch validates the CREATE response before using its fields, records the FIDs, marks the handle as open before processing errors from later commands, and adjusts reconnect handling to avoid missing reconnect requests. It also improves handle counting and close response processing to ensure proper resource management.

Improper handling of SMB2 compound requests could lead to resource mismanagement such as failure to close file handles properly. This may cause resource leaks or inconsistent SMB client state. No direct exploit or active attacks are reported. The impact is primarily on SMB client stability and resource cleanup correctness.

A fix has been implemented in the Linux kernel to address this vulnerability. Users should update to the fixed kernel version once it is available. No additional mitigation steps are indicated by the vendor advisory.