In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a… (CVE-2026-98449)

The Linux kernel SMB client had a flaw where, upon failure to send a compound request, the mids on the pending_mid_q were not deleted before unlocking the server. This caused cifs_abort_connection() to invoke callbacks that returned credits and decremented in_flight counters prematurely. Subsequently, the send-error path returned the same credits again, resulting in in_flight being decremented twice and triggering warnings in smb2_add_credits(). The fix involved deleting mids on send failure before unlocking and marking them as cancelled to prevent double deletion.

This vulnerability causes incorrect credit accounting in the SMB client, leading to kernel warnings and potential instability during SMB2 negotiation failures. There is no indication of remote code execution or privilege escalation. The impact is primarily on kernel stability and error handling during network communication failures.

A fix has been implemented in the Linux kernel to delete compound mids on send failure before unlocking the server and to mark them as cancelled to avoid double deletion. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.