Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98172
Published: October 7, 2026
Vulnerability identifier: #VU153854
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98172
CWE-ID: CWE-772
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause an RDMA connection resource leak.
The vulnerability exists due to missing release of an established RDMA connection in the Linux kernel SMB client's cifs_get_tcp_session() function when session setup fails after smbd_get_connection() successfully establishes the connection. A local user can trigger this error path to cause an RDMA connection resource leak.
The session setup failure can occur when kthread_create() returns an error.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98172
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/3164402c58940ff58a3cecdb026405f07b0253af
- https://git.kernel.org/stable/c/5c908e49d349266dff0c86dda6a05df0ff19b824
- https://git.kernel.org/stable/c/928edc4bd6a617caabeb575fc13c254d9df623c4
- https://git.kernel.org/stable/c/b26a3fcf2f1c2cadba400290b639f01395db8fc8
- https://git.kernel.org/stable/c/e3344bb0ff5ec8a276f42239e140f5442841ef23
- https://git.kernel.org/stable/c/e75c96157d45e498970158c8f7373d90102e33b9