Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98450

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU156748

Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98450

Published: October 22, 2026


Vulnerability identifier: #VU156748
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98450
CWE-ID: CWE-772
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to leak remote SMB file handles, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing resource release in the Linux kernel SMB client's compound_send_recv() function when a later response wait is interrupted or response synchronization fails after an earlier CREATE has completed. A local user can trigger compound SMB operations that encounter these failure conditions to leave successfully opened remote handles unclosed because their file identifiers have not been returned to the caller and cancelled-request cleanup is not invoked.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

How to mitigate CVE-2026-98450

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

External References

Related Security Bulletins