CVE-2026-23230smb: client: split cached_fid bitfields to avoid shared-byte RMW races
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ebe98f1447bbccf8228335c62d86af02a0ed23f7 before 569fecc56bfe4df66f05734d67daef887746656b; from ebe98f1447bbccf8228335c62d86af02a0ed23f7 before 4386f6af8aaedd0c5ad6f659b40cadcc8f423828; from ebe98f1447bbccf8228335c62d86af02a0ed23f7 before 3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a; from ebe98f1447bbccf8228335c62d86af02a0ed23f7 before c4b9edd55987384a1f201d3d07ff71e448d79c1b; from ebe98f1447bbccf8228335c62d86af02a0ed23f7 before 4cfa4c37dcbcfd70866e856200ed8a2894cac578; from ebe98f1447bbccf8228335c62d86af02a0ed23f7 before ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241 | CNA record |
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name) | before V4.0 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 6.1 before 6.1.164; from 6.2 before 6.6.125; from 6.7 before 6.12.72; from 6.13 before 6.18.11; from 6.19 before 6.19.1 | NVD |
References
- https://git.kernel.org/stable/c/569fecc56bfe4df66f05734d67daef887746656bpatch
- https://git.kernel.org/stable/c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828patch
- https://git.kernel.org/stable/c/3eaa22d688311c708b73f3c68bc6d0c8e3f0f77apatch
- https://git.kernel.org/stable/c/c4b9edd55987384a1f201d3d07ff71e448d79c1bpatch
- https://git.kernel.org/stable/c/4cfa4c37dcbcfd70866e856200ed8a2894cac578patch
- https://git.kernel.org/stable/c/ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241patch
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.