CVE-2026-68312

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68312", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.381Z", "datePublished": "2026-08-10T12:02:46.907Z", "dateUpdated": "2026-10-30T12:28:22.322Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:28:22.322Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths\n\nIn cifs_close_deferred_file(), cifs_close_all_deferred_files(), and\ncifs_close_deferred_file_under_dentry(), when a pending deferred close\nis cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to\nadd the file to the local processing list may fail under memory pressure.\nThe loop breaks immediately, but the cancelled work is no longer pending\n(it would have called _cifsFileInfo_put()), and the cfile is never added\nto file_head for processing. The cifsFileInfo reference and the open\nserver handle both leak.\n\nFix by saving the cfile that failed allocation in a local variable,\nbreaking as before, and calling _cifsFileInfo_put() on it after\nreleasing the lock. Any files later in the iteration are unaffected\nsince their deferred work is still pending and will fire normally."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/misc.c"], "versions": [{"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "lessThan": "75143abc21f627da7ee3b0336814bd702692e830", "status": "affected", "versionType": "git"}, {"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "lessThan": "c968b2417f6a15d35ff4b97d534af4a126cb510b", "status": "affected", "versionType": "git"}, {"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "lessThan": "7af7ec3af091f55d01f0ebe0246d10e37f358311", "status": "affected", "versionType": "git"}, {"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "lessThan": "6089f561e2c31a3ba52836c75c7d2ab50d2eea41", "status": "affected", "versionType": "git"}, {"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "lessThan": "32390b3f06f26e366cfb27dbac4bc0196c321535", "status": "affected", "versionType": "git"}, {"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "lessThan": "c2f2e83e3bbc5483730fd4ee903182761f1ae50f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/misc.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/75143abc21f627da7ee3b0336814bd702692e830"}, {"url": "https://git.kernel.org/stable/c/c968b2417f6a15d35ff4b97d534af4a126cb510b"}, {"url": "https://git.kernel.org/stable/c/7af7ec3af091f55d01f0ebe0246d10e37f358311"}, {"url": "https://git.kernel.org/stable/c/6089f561e2c31a3ba52836c75c7d2ab50d2eea41"}, {"url": "https://git.kernel.org/stable/c/32390b3f06f26e366cfb27dbac4bc0196c321535"}, {"url": "https://git.kernel.org/stable/c/c2f2e83e3bbc5483730fd4ee903182761f1ae50f"}], "title": "cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "75143abc21f627da7ee3b0336814bd702692e830", "status": "affected", "version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "versionType": "git"}, {"lessThan": "c968b2417f6a15d35ff4b97d534af4a126cb510b", "status": "affected", "version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "versionType": "git"}, {"lessThan": "7af7ec3af091f55d01f0ebe0246d10e37f358311", "status": "affected", "version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "versionType": "git"}, {"lessThan": "6089f561e2c31a3ba52836c75c7d2ab50d2eea41", "status": "affected", "version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "versionType": "git"}, {"lessThan": "32390b3f06f26e366cfb27dbac4bc0196c321535", "status": "affected", "version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "versionType": "git"}, {"lessThan": "c2f2e83e3bbc5483730fd4ee903182761f1ae50f", "status": "affected", "version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths\n\nIn cifs_close_deferred_file(), cifs_close_all_deferred_files(), and\ncifs_close_deferred_file_under_dentry(), when a pending deferred close\nis cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to\nadd the file to the local processing list may fail under memory pressure.\nThe loop breaks immediately, but the cancelled work is no longer pending\n(it would have called _cifsFileInfo_put()), and the cfile is never added\nto file_head for processing. The cifsFileInfo reference and the open\nserver handle both leak.\n\nFix by saving the cfile that failed allocation in a local variable,\nbreaking as before, and calling _cifsFileInfo_put() on it after\nreleasing the lock. Any files later in the iteration are unaffected\nsince their deferred work is still pending and will fire normally."}], "id": "CVE-2026-68312", "lastModified": "2026-10-30T13:19:43.427", "metrics": {}, "published": "2026-08-10T13:20:21.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32390b3f06f26e366cfb27dbac4bc0196c321535"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6089f561e2c31a3ba52836c75c7d2ab50d2eea41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/75143abc21f627da7ee3b0336814bd702692e830"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7af7ec3af091f55d01f0ebe0246d10e37f358311"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c2f2e83e3bbc5483730fd4ee903182761f1ae50f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c968b2417f6a15d35ff4b97d534af4a126cb510b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths", "id": "2513398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513398"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths\nIn cifs_close_deferred_file(), cifs_close_all_deferred_files(), and\ncifs_close_deferred_file_under_dentry(), when a pending deferred close\nis cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to\nadd the file to the local processing list may fail under memory pressure.\nThe loop breaks immediately, but the cancelled work is no longer pending\n(it would have called _cifsFileInfo_put()), and the cfile is never added\nto file_head for processing. The cifsFileInfo reference and the open\nserver handle both leak.\nFix by saving the cfile that failed allocation in a local variable,\nbreaking as before, and calling _cifsFileInfo_put() on it after\nreleasing the lock. Any files later in the iteration are unaffected\nsince their deferred work is still pending and will fire normally.", "A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a deferred file close operation is cancelled and memory allocation fails under pressure, a cifsFileInfo reference and an open server handle can leak. This resource leak could potentially lead to a Denial of Service (DoS) over time due to resource exhaustion."], "name": "CVE-2026-68312", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68312\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68312\nhttps://lore.kernel.org/linux-cve-announce/2026081032-CVE-2026-68312-6ef4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3fc065682ebbbd15b0ce0036800f4acbf765d46,32390b3f06f26e366cfb27dbac4bc0196c321535)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3fc065682ebbbd15b0ce0036800f4acbf765d46,c2f2e83e3bbc5483730fd4ee903182761f1ae50f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T17:15:03.144366+00:00", "updated": "2026-08-13T04:30:06.235713+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}