CVE-2026-98450: Linux Vulnerability

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle. The earlier mid is then released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller. Mark completed earlier mids as cancelled when a compound wait or MID synchronization aborts. Keep their response buffers attached while the MIDs are synchronized, and transfer them only after synchronization of the processed responses, so the release path can inspect successful CREATE responses and queue SMB2_close() after a later failure. Account for a remote open only after the close work is allocated and before it is queued, since the caller has not yet updated num_remote_opens. Mark the create+close compound used by smb2_unlink() so it is not closed again. Non-CREATE responses and compounds that already include a close keep their existing behavior.

Metrics

EPSS Probability

0.17%

6.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= e0bba0b8548179b696e86c158ea8f45f2ef6ad14, < da83fed81241b03fd0e7ccf0091b051cf420d8d2; >= e0bba0b8548179b696e86c158ea8f45f2ef6ad14, < e94370cf2b76e913a997e9a633ab521a45029284; >= e0bba0b8548179b696e86c158ea8f45f2ef6ad14, < c8c6c7e665af4dba75a02f4c9bad3ae2ce341619; >= e0bba0b8548179b696e86c158ea8f45f2ef6ad14, < 8afc80156b1d9e2cfd02d42c255305fad95b59fc; >= e0bba0b8548179b696e86c158ea8f45f2ef6ad14, < 2cb07d1a6a30283dbfc809c8036bc1fd103d59fa; >= e0bba0b8548179b696e86c158ea8f45f2ef6ad14, < 224b56b7c02b2bfb1f5bee18d5f56ae6b052be44; >= e0bba0b8548179b696e86c158ea8f45f2ef6ad14, < 253612499ce9b4cd7bb922fe507ec204bddd9313; >= e0bba0b8548179b696e86c158ea8f45f2ef6ad14, < 6c5c547f037bc18f0b8d0b5db5a648f8f630ce85
Linux	Linux	4.19

References

Timeline

Published: Oct 18, 2026
Last Modified: Oct 30, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-98450?

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle. The earlier mid is then released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller. Mark completed earlier mids as cancelled when a compound wait or MID synchronization aborts. Keep their response buffers attached while the MIDs are synchronized, and transfer them only after synchronization of the processed responses, so the release path can inspect successful CREATE responses and queue SMB2_close() after a later failure. Account for a remote open only after the close work is allocated and before it is queued, since the caller has not yet updated num_remote_opens. Mark the create+close compound used by smb2_unlink() so it is not closed again. Non-CREATE responses and compounds that already include a close keep their existing behavior.

How severe is CVE-2026-98450?

Severity scoring for CVE-2026-98450 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.

How do I fix CVE-2026-98450?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →