Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97556— smb: client: avoid leaking refcount when cifs_sb_tlink() fails

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： smb: 客户端：当 失败时，避免引用计数泄漏 会接管 在排队工作时所获取的引用，并在处理完锁中断后通过 释放该引用。 仅在启用 选项的配置中， 可能失败。此时， 会直接返回，而未释放文件引用，这复现了我们在 的配套补丁中已修复的另一处引用计数泄漏问题。 这种情况会在下一次卸载操作时因 inode 仍在使用（busy inodes）而触发系统崩溃： 因此，在该失败路径上也需释放引用。此释放操作位于 标签之前，与正常路径保持一致，即在调用 之前释放引用。 此问题由 Sashi

AI Predicted 3.3 Difficulty: Theoretical EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 19

VendorProduct Version RangeStatus
Linux Linux 5ee28bcfbaacf289eb25c662a2862542ea6ce6a7< 55c5f095d4df14271b238f826e1392fda7b6e60e affected
e8f5f849ffce24490eb9449e98312b66c0dba76f< e9c5bcc88b8337157e480c85a6d2f326bc265012 affected
e8f5f849ffce24490eb9449e98312b66c0dba76f< 9ec991e148368e3207e98134c509a625097f7693 affected
e8f5f849ffce24490eb9449e98312b66c0dba76f< dd03fd658ea59821505e0e643b6b7cbdf51c4e1d affected
e8f5f849ffce24490eb9449e98312b66c0dba76f< 1d1b0f1d812a4011a57bc6c70492c34a2e46c6dd affected
e8f5f849ffce24490eb9449e98312b66c0dba76f< 23b26f4408ac3f35a482d2e5cf6fc865d4201b71 affected
b99f490ea87ebcca3a429fd8837067feb56a4c7c affected
6b67a6d2e50634fe127e656147c81915955e9f5e affected
… +11 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97556

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
smb: client: avoid leaking refcount when cifs_sb_tlink() fails
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifs_sb_tlink() fails cifs_oplock_break() takes over the reference that cifs_queue_oplock_break() acquired when it queued the work, and drops it with _cifsFileInfo_put() once the break has been processed. Only in setups with "-o multiuser", cifs_sb_tlink() may fail, at which point cifs_oplock_break() returns without putting the file reference, mirroring the reference leak we already fixed in the companion patch to cifs_queue_oplock_break(). This would trigger a crash due to busy inodes on the next unmount: BUG: Dentry ... still in use (1) [unmount of cifs cifs] VFS: Busy inodes after unmount of cifs (cifs) Drop the reference on that path as well. Doing so before the out label mirrors the normal path, which also puts the reference before cifs_done_oplock_break(). Found by Sashiko code review. The failure path was not exercised at runtime.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5ee28bcfbaacf289eb25c662a2862542ea6ce6a7 ~ 55c5f095d4df14271b238f826e1392fda7b6e60e -
Linux Linux 6.5 -

II. Public POCs for CVE-2026-97556

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97556

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-97556 (6)

Same Patch Batch · Linux · 2026-09-25 · 372 CVEs total

CVE-2026-100075 9.8 CRITICAL RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
CVE-2026-97957 8.8 HIGH net: hinic: fix mailbox segment buffer overflow
CVE-2026-97527 8.8 HIGH scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
CVE-2026-97528 8.8 HIGH scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
CVE-2026-97555 8.8 HIGH smb: client: fix heap overflow in DACL owner/group rewrite
CVE-2026-98115 8.8 HIGH ksmbd: safely drain sessions during logoff
CVE-2026-97525 8.2 HIGH x86/mm/pat: Allocate split page tables as kernel page tables
CVE-2026-97573 8.1 HIGH bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
CVE-2026-98070 8.1 HIGH net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
CVE-2026-97570 8.1 HIGH bnxt_en: Bound SW TPA IDs to prevent crashes
CVE-2026-98069 8.1 HIGH net/rds: acquire the fastpath locks in rds_conn_shutdown()
CVE-2026-98130 8.1 HIGH sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
CVE-2026-98116 7.8 HIGH ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
CVE-2026-97903 7.8 HIGH exit: hold a reference to thread_pid across proc_flush_pid
CVE-2026-97548 7.8 HIGH xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
CVE-2026-97611 7.8 HIGH net: openvswitch: fix use-after-free of the flow table mask array
CVE-2026-97612 7.8 HIGH net: mpls: clear inner_protocol when the last label is popped
CVE-2026-98073 7.8 HIGH net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
CVE-2026-97602 7.8 HIGH inet: frags: invalidate queues before flushing them
CVE-2026-97577 7.8 HIGH media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

Showing top 20 of 372 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-97556

No comments yet

Leave a comment