SB20260812210 - Improper resource shutdown or release in Linux kernel smb client

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-68312)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry() when handling deferred close cancellation and allocation failure under memory pressure. A local user can trigger deferred close processing in low-memory conditions to cause a denial of service.

The issue occurs when cancel_delayed_work() succeeds and the subsequent allocation for local processing fails, causing a cifsFileInfo reference and an open server handle to leak.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/32390b3f06f26e366cfb27dbac4bc0196c321535
• https://git.kernel.org/stable/c/c2f2e83e3bbc5483730fd4ee903182761f1ae50f