SB2026102209 - Improper resource shutdown or release in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-98439)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service by preventing an SMB connection from closing.

The vulnerability exists due to improper resource shutdown in the Linux kernel SMB server when closing a connection with active asynchronous requests. A remote user can initiate an asynchronous request that remains pending and disconnect to cause connection teardown to stall while the server waits for the request to finish.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0947087678f465b64eba2acebe808d5c6cfea036
• https://git.kernel.org/stable/c/4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851