In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors… (CVE-2026-98450)

The vulnerability in the Linux kernel SMB client occurs in compound_send_recv(), which waits for SMB responses in order. If a later wait is interrupted or a later MID fails during response synchronization, an earlier CREATE operation may have opened a remote handle that is not properly closed because the earlier MID is released without calling handle_cancelled_mid(). This leaves the remote handle open since no file identifier (FID) is copied to the caller. The patch marks completed earlier MIDs as cancelled when a compound wait or MID synchronization aborts, retains their response buffers during synchronization, and only transfers them after synchronization. This allows the release path to inspect successful CREATE responses and queue SMB2_close() after a later failure, preventing remote handle leaks. Additional logic prevents double closing in certain compound operations.

The vulnerability can cause remote file handles to remain open unintentionally, potentially leading to resource leaks on SMB servers. This could degrade server performance or cause unexpected behavior in file operations over SMB. There is no indication of direct code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by properly handling compound wait errors and ensuring remote handles are closed appropriately. Users should apply the official kernel updates that include this patch once available. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation.