CVE-2026-98452

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98452", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.350Z", "datePublished": "2026-10-18T15:15:02.436Z", "dateUpdated": "2026-10-19T09:19:47.547Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:19:47.547Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clean up failed cached directory opens\n\nopen_cached_dir() sends CREATE and QUERY_INFO as a compound request. If\nthe CREATE succeeds but a later command returns an error, the function\nmust retain the CREATE FID so common cleanup can issue SMB2_close(). It\nalso must not treat a response error as a valid CREATE.\n\nValidate the CREATE response before using its fields, record the FIDs, and\nmark the handle open before handling errors from later compound commands.\nMove the -EREMCHG reconnect handling before response validation so a\nmissing response does not hide the reconnect request. Count the handle\nwhen it is marked open; confirmed close responses decrement the counter,\nwhile existing close retry behavior remains best effort on transport\nfailures."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cached_dir.c"], "versions": [{"version": "b0f6df737a1c5d9d5ff90cc946205d8af46cc067", "lessThan": "48958ddda3d7eee3600261e2d90671f63e055dc4", "status": "affected", "versionType": "git"}, {"version": "b0f6df737a1c5d9d5ff90cc946205d8af46cc067", "lessThan": "abab661eed00fa102d3c35ddf1cce4f687e718c1", "status": "affected", "versionType": "git"}, {"version": "b0f6df737a1c5d9d5ff90cc946205d8af46cc067", "lessThan": "7c1509598a4fdfb54cb09ce33e4405bd6dbd8295", "status": "affected", "versionType": "git"}, {"version": "b0f6df737a1c5d9d5ff90cc946205d8af46cc067", "lessThan": "d2ff5fb93ea83034025850266b5eed391f96b825", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cached_dir.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/48958ddda3d7eee3600261e2d90671f63e055dc4"}, {"url": "https://git.kernel.org/stable/c/abab661eed00fa102d3c35ddf1cce4f687e718c1"}, {"url": "https://git.kernel.org/stable/c/7c1509598a4fdfb54cb09ce33e4405bd6dbd8295"}, {"url": "https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825"}], "title": "smb: client: clean up failed cached directory opens", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/cached_dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "48958ddda3d7eee3600261e2d90671f63e055dc4", "status": "affected", "version": "b0f6df737a1c5d9d5ff90cc946205d8af46cc067", "versionType": "git"}, {"lessThan": "abab661eed00fa102d3c35ddf1cce4f687e718c1", "status": "affected", "version": "b0f6df737a1c5d9d5ff90cc946205d8af46cc067", "versionType": "git"}, {"lessThan": "7c1509598a4fdfb54cb09ce33e4405bd6dbd8295", "status": "affected", "version": "b0f6df737a1c5d9d5ff90cc946205d8af46cc067", "versionType": "git"}, {"lessThan": "d2ff5fb93ea83034025850266b5eed391f96b825", "status": "affected", "version": "b0f6df737a1c5d9d5ff90cc946205d8af46cc067", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/cached_dir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clean up failed cached directory opens\n\nopen_cached_dir() sends CREATE and QUERY_INFO as a compound request. If\nthe CREATE succeeds but a later command returns an error, the function\nmust retain the CREATE FID so common cleanup can issue SMB2_close(). It\nalso must not treat a response error as a valid CREATE.\n\nValidate the CREATE response before using its fields, record the FIDs, and\nmark the handle open before handling errors from later compound commands.\nMove the -EREMCHG reconnect handling before response validation so a\nmissing response does not hide the reconnect request. Count the handle\nwhen it is marked open; confirmed close responses decrement the counter,\nwhile existing close retry behavior remains best effort on transport\nfailures."}], "id": "CVE-2026-98452", "lastModified": "2026-10-19T10:18:54.437", "metrics": {}, "published": "2026-10-18T16:16:55.537", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/48958ddda3d7eee3600261e2d90671f63e055dc4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c1509598a4fdfb54cb09ce33e4405bd6dbd8295"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abab661eed00fa102d3c35ddf1cce4f687e718c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: clean up failed cached directory opens", "id": "2554831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554831"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-771", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: clean up failed cached directory opens\nopen_cached_dir() sends CREATE and QUERY_INFO as a compound request. If\nthe CREATE succeeds but a later command returns an error, the function\nmust retain the CREATE FID so common cleanup can issue SMB2_close(). It\nalso must not treat a response error as a valid CREATE.\nValidate the CREATE response before using its fields, record the FIDs, and\nmark the handle open before handling errors from later compound commands.\nMove the -EREMCHG reconnect handling before response validation so a\nmissing response does not hide the reconnect request. Count the handle\nwhen it is marked open; confirmed close responses decrement the counter,\nwhile existing close retry behavior remains best effort on transport\nfailures.", "A flaw was found in the Linux kernel's Server Message Block (SMB) client. When opening cached directories, the client fails to validate server responses to compound commands before reading their contents and handling file identifiers. A malicious or compromised SMB server could exploit this flaw by returning a malformed or unexpected response, causing invalid memory access and resulting in a Denial of Service (DoS) via a kernel crash."], "name": "CVE-2026-98452", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98452\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98452\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98452.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0f6df737a1c5d9d5ff90cc946205d8af46cc067,48958ddda3d7eee3600261e2d90671f63e055dc4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0f6df737a1c5d9d5ff90cc946205d8af46cc067,abab661eed00fa102d3c35ddf1cce4f687e718c1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0f6df737a1c5d9d5ff90cc946205d8af46cc067,7c1509598a4fdfb54cb09ce33e4405bd6dbd8295)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0f6df737a1c5d9d5ff90cc946205d8af46cc067,d2ff5fb93ea83034025850266b5eed391f96b825)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-19T00:00:10.776684+00:00", "updated": "2026-10-20T21:00:18.200170+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}