CVE-2026-98449smb: client: delete compound mids on send failure before unlock
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server without removing them first. During reconnect, cifs_abort_connection() walks pending_mid_q and runs each mid callback. With no response yet, those callbacks return credits and drop in_flight. Then compound_send_recv()'s send-error path returns the same credits again. in_flight ends up decremented twice and smb2_add_credits() WARNs. syzbot hits this during SMB2_negotiate when the socket send fails. cifs_call_async() already calls delete_mid() before unlock on send failure. Do the same for compound chains and set cancelled_mid[] so the out: path does not delete them again.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from ee258d79159afed52ca9372aeb9c1a51e89b32ee before 70783946f3b5d0c06ec7df0f5e7bec2bfad24efb; from ee258d79159afed52ca9372aeb9c1a51e89b32ee before 8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9; 3c57a0be487088b08d9c88998f911eb4a7ba36e4; from 4.20.11 before 4.21 | CNA record |
References
- https://git.kernel.org/stable/c/70783946f3b5d0c06ec7df0f5e7bec2bfad24efb
- https://git.kernel.org/stable/c/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.