« Volver al listado

CVE-2026-98172

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g. kthread_create() returns an error), the error path frees tcp_ses without first destroying the smbd_connection.

Fix this by calling smbd_destroy() in the out_err cleanup path before kfree(tcp_ses). smbd_destroy() safely handles the case where smbd_conn is NULL, so it can be called unconditionally.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98172",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "lessThan": "3164402c58940ff58a3cecdb026405f07b0253af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "lessThan": "e3344bb0ff5ec8a276f42239e140f5442841ef23",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "lessThan": "5c908e49d349266dff0c86dda6a05df0ff19b824",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "lessThan": "928edc4bd6a617caabeb575fc13c254d9df623c4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "lessThan": "b26a3fcf2f1c2cadba400290b639f01395db8fc8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
              "lessThan": "e75c96157d45e498970158c8f7373d90102e33b9",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:17:58.920",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3164402c58940ff58a3cecdb026405f07b0253af",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5c908e49d349266dff0c86dda6a05df0ff19b824",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/928edc4bd6a617caabeb575fc13c254d9df623c4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b26a3fcf2f1c2cadba400290b639f01395db8fc8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e3344bb0ff5ec8a276f42239e140f5442841ef23",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e75c96157d45e498970158c8f7373d90102e33b9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbd_connection leak on cifs_get_tcp_session() error\n\nWhen an RDMA connection is successfully established via\nsmbd_get_connection() but cifs_get_tcp_session() later fails (e.g.\nkthread_create() returns an error), the error path frees tcp_ses\nwithout first destroying the smbd_connection.\n\nFix this by calling smbd_destroy() in the out_err cleanup path before\nkfree(tcp_ses).  smbd_destroy() safely handles the case where\nsmbd_conn is NULL, so it can be called unconditionally."
    }
  ],
  "lastModified": "2026-10-06T09:17:58.920",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}