CVE-2026-98172

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98172", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.322Z", "datePublished": "2026-10-06T08:44:16.721Z", "dateUpdated": "2026-10-30T12:37:51.075Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:37:51.075Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbd_connection leak on cifs_get_tcp_session() error\n\nWhen an RDMA connection is successfully established via\nsmbd_get_connection() but cifs_get_tcp_session() later fails (e.g.\nkthread_create() returns an error), the error path frees tcp_ses\nwithout first destroying the smbd_connection.\n\nFix this by calling smbd_destroy() in the out_err cleanup path before\nkfree(tcp_ses). smbd_destroy() safely handles the case where\nsmbd_conn is NULL, so it can be called unconditionally."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/connect.c"], "versions": [{"version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "lessThan": "c295f6505aec085d73e8dcea9f648c8af1b9da8c", "status": "affected", "versionType": "git"}, {"version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "lessThan": "45a97df1b7fe6c1ca5493f8fb5284203991aeeb9", "status": "affected", "versionType": "git"}, {"version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "lessThan": "3164402c58940ff58a3cecdb026405f07b0253af", "status": "affected", "versionType": "git"}, {"version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "lessThan": "e3344bb0ff5ec8a276f42239e140f5442841ef23", "status": "affected", "versionType": "git"}, {"version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "lessThan": "5c908e49d349266dff0c86dda6a05df0ff19b824", "status": "affected", "versionType": "git"}, {"version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "lessThan": "928edc4bd6a617caabeb575fc13c254d9df623c4", "status": "affected", "versionType": "git"}, {"version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "lessThan": "b26a3fcf2f1c2cadba400290b639f01395db8fc8", "status": "affected", "versionType": "git"}, {"version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "lessThan": "e75c96157d45e498970158c8f7373d90102e33b9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/connect.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c295f6505aec085d73e8dcea9f648c8af1b9da8c"}, {"url": "https://git.kernel.org/stable/c/45a97df1b7fe6c1ca5493f8fb5284203991aeeb9"}, {"url": "https://git.kernel.org/stable/c/3164402c58940ff58a3cecdb026405f07b0253af"}, {"url": "https://git.kernel.org/stable/c/e3344bb0ff5ec8a276f42239e140f5442841ef23"}, {"url": "https://git.kernel.org/stable/c/5c908e49d349266dff0c86dda6a05df0ff19b824"}, {"url": "https://git.kernel.org/stable/c/928edc4bd6a617caabeb575fc13c254d9df623c4"}, {"url": "https://git.kernel.org/stable/c/b26a3fcf2f1c2cadba400290b639f01395db8fc8"}, {"url": "https://git.kernel.org/stable/c/e75c96157d45e498970158c8f7373d90102e33b9"}], "title": "smb: client: fix smbd_connection leak on cifs_get_tcp_session() error", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/connect.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c295f6505aec085d73e8dcea9f648c8af1b9da8c", "status": "affected", "version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "versionType": "git"}, {"lessThan": "45a97df1b7fe6c1ca5493f8fb5284203991aeeb9", "status": "affected", "version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "versionType": "git"}, {"lessThan": "3164402c58940ff58a3cecdb026405f07b0253af", "status": "affected", "version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "versionType": "git"}, {"lessThan": "e3344bb0ff5ec8a276f42239e140f5442841ef23", "status": "affected", "version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "versionType": "git"}, {"lessThan": "5c908e49d349266dff0c86dda6a05df0ff19b824", "status": "affected", "version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "versionType": "git"}, {"lessThan": "928edc4bd6a617caabeb575fc13c254d9df623c4", "status": "affected", "version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "versionType": "git"}, {"lessThan": "b26a3fcf2f1c2cadba400290b639f01395db8fc8", "status": "affected", "version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "versionType": "git"}, {"lessThan": "e75c96157d45e498970158c8f7373d90102e33b9", "status": "affected", "version": "2f8946464b11822169b9f10c7cf58a2440b51d54", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/connect.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbd_connection leak on cifs_get_tcp_session() error\n\nWhen an RDMA connection is successfully established via\nsmbd_get_connection() but cifs_get_tcp_session() later fails (e.g.\nkthread_create() returns an error), the error path frees tcp_ses\nwithout first destroying the smbd_connection.\n\nFix this by calling smbd_destroy() in the out_err cleanup path before\nkfree(tcp_ses). smbd_destroy() safely handles the case where\nsmbd_conn is NULL, so it can be called unconditionally."}], "id": "CVE-2026-98172", "lastModified": "2026-10-30T13:21:11.527", "metrics": {}, "published": "2026-10-06T09:17:58.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3164402c58940ff58a3cecdb026405f07b0253af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/45a97df1b7fe6c1ca5493f8fb5284203991aeeb9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5c908e49d349266dff0c86dda6a05df0ff19b824"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/928edc4bd6a617caabeb575fc13c254d9df623c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b26a3fcf2f1c2cadba400290b639f01395db8fc8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c295f6505aec085d73e8dcea9f648c8af1b9da8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e3344bb0ff5ec8a276f42239e140f5442841ef23"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e75c96157d45e498970158c8f7373d90102e33b9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: fix smbd_connection leak on cifs_get_tcp_session() error", "id": "2546508", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546508"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: fix smbd_connection leak on cifs_get_tcp_session() error\nWhen an RDMA connection is successfully established via\nsmbd_get_connection() but cifs_get_tcp_session() later fails (e.g.\nkthread_create() returns an error), the error path frees tcp_ses\nwithout first destroying the smbd_connection.\nFix this by calling smbd_destroy() in the out_err cleanup path before\nkfree(tcp_ses). smbd_destroy() safely handles the case where\nsmbd_conn is NULL, so it can be called unconditionally.", "A flaw was found in the Linux kernel's Server Message Block (SMB) client subsystem. When establishing a Remote Direct Memory Access (RDMA) session, an error during session initialization can cause the cleanup routine to release the session structure without first terminating the active RDMA connection. This issue leads to a kernel resource and memory leak, which can be triggered repeatedly to cause system resource exhaustion and a Denial of Service (DoS)."], "name": "CVE-2026-98172", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98172\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98172\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98172.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f8946464b11822169b9f10c7cf58a2440b51d54,3164402c58940ff58a3cecdb026405f07b0253af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f8946464b11822169b9f10c7cf58a2440b51d54,e3344bb0ff5ec8a276f42239e140f5442841ef23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f8946464b11822169b9f10c7cf58a2440b51d54,5c908e49d349266dff0c86dda6a05df0ff19b824)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f8946464b11822169b9f10c7cf58a2440b51d54,928edc4bd6a617caabeb575fc13c254d9df623c4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f8946464b11822169b9f10c7cf58a2440b51d54,b26a3fcf2f1c2cadba400290b639f01395db8fc8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f8946464b11822169b9f10c7cf58a2440b51d54,e75c96157d45e498970158c8f7373d90102e33b9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T16:45:02.588640+00:00", "updated": "2026-10-07T17:00:19.321564+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}