SB2026102220 - Missing Release of Resource after Effective Lifetime in Linux kernel smb client

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102220

SB2026102220 - Missing Release of Resource after Effective Lifetime in Linux kernel smb client

Published: October 22, 2026

Security Bulletin ID SB2026102220
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98450)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to leak remote SMB file handles, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing resource release in the Linux kernel SMB client's compound_send_recv() function when a later response wait is interrupted or response synchronization fails after an earlier CREATE has completed. A local user can trigger compound SMB operations that encounter these failure conditions to leave successfully opened remote handles unclosed because their file identifiers have not been returned to the caller and cancelled-request cleanup is not invoked.


Remediation

Install update from vendor's website.

References