Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97557— smb: client: avoid leaking refcount in cifs_queue_oplock_break()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： smb: 客户端：避免在 cifs_queue_oplock_break() 中泄漏引用计数 cifs_queue_oplock_break() 函数在向 cifs_oplock_break() 任务排队之前，无条件地对目标文件获取一个引用（reference）。只有该工作项（work item）执行完毕后才会再次减少引用计数。 如果在该工作项仍在队列中时又有另一个 oplock 中断到达，queue_work() 将返回 false，且不会将该第二个工作项加入队列。因此，

CVSS 7.5 · High EPSS 0.66% · P50

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 24

VendorProduct Version RangeStatus
Linux Linux b98749cac4a695f084a5ff076f4510b23e353ecd< 735a3a610136ae10f381d0909dff38e5b5c5f056 affected
b98749cac4a695f084a5ff076f4510b23e353ecd< de2a6bcff2659bea40c7485115b57f0ae189fc01 affected
b98749cac4a695f084a5ff076f4510b23e353ecd< af0193bbf1ac8c0f67f972998b0cc629d6116cf6 affected
b98749cac4a695f084a5ff076f4510b23e353ecd< 2ed2c29dd9593637cfa25ac1eb23241b20202778 affected
b98749cac4a695f084a5ff076f4510b23e353ecd< dfe7b750c7e069873a8a57a11c816831a235618a affected
b98749cac4a695f084a5ff076f4510b23e353ecd< 9f2e63f1b2d5fc5b5423424902c091123e220e7e affected
2429fcf06d3cb962693868ab0a927c9038f12a2d affected
1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12 affected
… +16 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97557

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
smb: client: avoid leaking refcount in cifs_queue_oplock_break()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifs_queue_oplock_break() cifs_queue_oplock_break() unconditionally takes a reference on the target file before queueing cifs_oplock_break(). Only that work item decreases the reference counter again. If another oplock break arrives while that work is still queued, queue_work() will return false and not queue this second work item. As a result, we will never reach the point to drop the file reference again and are leaking this reference. This can be triggered when interacting with a slow-responding server. As a result, later unmount operations for this file system will fail with BUG: Dentry ... still in use (1) [unmount of cifs cifs] VFS: Busy inodes after unmount of cifs (cifs) kernel BUG at fs/super.c:777! Fix this by only incrementing the reference count if the work has been queued successfully. Taking it after queue_work() is safe because all three callers hold tcon->open_file_lock across the call and _cifsFileInfo_put() decrements under that same lock, so a worker that starts the handler in the window cannot drop the reference before it has been taken.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b98749cac4a695f084a5ff076f4510b23e353ecd ~ 735a3a610136ae10f381d0909dff38e5b5c5f056 -
Linux Linux 5.1 -

II. Public POCs for CVE-2026-97557

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97557

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-97557 (6)

Same Patch Batch · Linux · 2026-09-25 · 372 CVEs total

CVE-2026-100075 9.8 CRITICAL RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
CVE-2026-97957 8.8 HIGH net: hinic: fix mailbox segment buffer overflow
CVE-2026-97527 8.8 HIGH scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
CVE-2026-97528 8.8 HIGH scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
CVE-2026-97555 8.8 HIGH smb: client: fix heap overflow in DACL owner/group rewrite
CVE-2026-98115 8.8 HIGH ksmbd: safely drain sessions during logoff
CVE-2026-97525 8.2 HIGH x86/mm/pat: Allocate split page tables as kernel page tables
CVE-2026-98130 8.1 HIGH sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
CVE-2026-97573 8.1 HIGH bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
CVE-2026-98069 8.1 HIGH net/rds: acquire the fastpath locks in rds_conn_shutdown()
CVE-2026-98070 8.1 HIGH net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
CVE-2026-97570 8.1 HIGH bnxt_en: Bound SW TPA IDs to prevent crashes
CVE-2026-97911 7.8 HIGH accel: ethosu: Ensure SRAM region size matches job
CVE-2026-98116 7.8 HIGH ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
CVE-2026-97910 7.8 HIGH ASoC: sprd: validate compress buffer sizes against fixed allocations
CVE-2026-98143 7.8 HIGH accel: ethosu: Don't read the U65 rounding mode as a storage mode
CVE-2026-97903 7.8 HIGH exit: hold a reference to thread_pid across proc_flush_pid
CVE-2026-97548 7.8 HIGH xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
CVE-2026-97602 7.8 HIGH inet: frags: invalidate queues before flushing them
CVE-2026-98073 7.8 HIGH net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().

Showing top 20 of 372 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-97557

No comments yet

Leave a comment