Improper resource shutdown or release in Linux kernel - CVE-2026-98439
Published: October 22, 2026
Vulnerability identifier: #VU156737
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98439
CWE-ID: CWE-404
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service by preventing an SMB connection from closing.
The vulnerability exists due to improper resource shutdown in the Linux kernel SMB server when closing a connection with active asynchronous requests. A remote user can initiate an asynchronous request that remains pending and disconnect to cause connection teardown to stall while the server waits for the request to finish.
Affected software
Linux kernel
How to mitigate CVE-2026-98439
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3