Skip to main content

Linux Kernel EUVDEUVD-2026-86865

| CVE-2026-97557 HIGH
2026-09-25 Linux GHSA-v47h-9mpw-4682
Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Victim mounts SMB/CIFS share from attacker/slow server
  2. Delivery
    Server delays oplock-break responses
  3. Exploit
    Second oplock break queued during pending work
  4. Execution
    queue_work() returns false, file reference leaked
  5. Impact
    Unmount hits fs/super.c:777 BUG (kernel DoS)

Vulnerability Assessment

Exploitation Conditions

Requires the Linux host to have an SMB/CIFS filesystem mounted from a server the attacker controls or that responds slowly, so that oplock-break traffic can be timed. The specific trigger is a second oplock break arriving while the first cifs_oplock_break work item is still queued (queue_work() returns false), leaking a cifsFileInfo reference; the failure only manifests as a kernel BUG when that filesystem is later unmounted. Limiting factors: mounting the share is normally a privileged operation (CAP_SYS_ADMIN), the race window is timing-dependent (not deterministic), and the outcome is availability loss only - no code execution, data read, or data modification.
Impact

This is a moderate-to-low real-world risk despite the NVD 7.5 (HIGH) rating. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is availability-only (C:N/I:N) - there is no confidentiality or integrity impact, so the 'Information Disclosure' tag in the input is factually wrong. The impact is a kernel reference-count leak in the CIFS/SMB client that eventually causes 'Busy inodes' / BUG at fs/super.c:777 on unmount - a denial-of-service, not data exposure. I dispute AC:L and PR:N: the leak is a race that requires a second oplock break to arrive while the first work item is still queued ('when interacting with a slow-responding server'), which is a timing-dependent window (AC:H), and the SMB share must first be mounted (normally CAP_SYS_ADMIN), which argues for PR:L rather than PR:N. My independent estimate is ~5.3 (MEDIUM). No EPSS score, no CISA KEV listing, and no public exploit were provided; exploitation status is 'no public exploit identified at time of analysis'. Net: a legitimate stability bug worth patching in CIFS-client fleets, but not an urgent, weaponizable priority.
Exploit ScenarioDerived

A Linux host mounts an SMB/CIFS share from an attacker-controlled or simply slow/unreliable server. By delaying oplock-break responses so that a second oplock break arrives while the first cifs_oplock_break work item is still queued, the server induces queue_work() to return false and the file reference is leaked; a subsequent unmount of that share then hits the fs/super.c BUG and panics/hangs. No public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A reference-count leak in the Linux kernel CIFS/SMB client's oplock-break handling (cifs_queue_oplock_break) allows a failure path to hold an extra cifsFileInfo reference, which later causes unmount of the CIFS filesystem to fail with 'VFS: Busy inodes after unmount' and a kernel BUG at fs/super.c:777, resulting in a denial-of-service condition on affected hosts. The flaw is reachable when a second oplock break arrives while the first cifs_oplock_break work item is still queued, causing queue_work() to return false and the corresponding reference drop to be skipped; triggering it requires an SMB/CIFS share mounted from a server the attacker controls or that responds slowly, and mounting a share is normally a privileged operation on the client. No public exploit code was identified at time of analysis, and this issue is not in CISA KEV; while NVD assigns 7.5 (HIGH), the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, making this a moderate-to-low real-world risk because the race window is timing-dependent and the outcome is availability loss only.

RemediationAI

Apply the vendor-released kernel patch by updating to a version containing the fix commits: stable releases 6.12.111, 6.18.53, and 7.2.7 (or 7.3-rc3 in the mainline candidate stream), with per-branch fixes published at https://git.kernel.org/stable/c/af0193bbf1ac8c0f67f972998b0cc629d6116cf6, https://git.kernel.org/stable/c/2ed2c29dd9593637cfa25ac1eb23241b20202778, https://git.kernel.org/stable/c/dfe7b750c7e069873a8a57a11c816831a235618a, and https://git.kernel.org/stable/c/9f2e63f1b2d5fc5b5423424902c091123e220e7e, and the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-97557. Because the patch is upstream, some distributions may backport it into older LTS kernels, so operators should track their distribution's kernel security update rather than relying solely on upstream version numbers. Where patching must be deferred, the practical compensating control is to reduce exposure through SMB mounts: avoid mounting shares from untrusted or unusually slow-responding SMB servers on hosts where unmount reliability is critical, and unmount CIFS shares before they become the target of the race - though this is a partial mitigation because the same traffic could originate from any server the mount connects to. Disabling client-side oplock handling is not a clean workaround and may degrade SMB performance and cache coherency, and restricting mounts to trusted servers only (via mount.cifs options, autofs policy, or network segmentation of SMB traffic) carries the trade-off of reduced flexibility for end users who legitimately mount external shares. Note that triggering the issue requires an attacker-influenced or slow SMB server plus the ability to mount the share (typically CAP_SYS_ADMIN on the client), so tightening who may mount network filesystems meaningfully shrinks the attack surface until the kernel fix is deployed.

Affected VersionsENISA

Linux 5.1
Linux patch: 0
Linux b98749cac4a695f084a5ff076f4510b23e353ecd <af0193bbf1ac8c0f67f972998b0cc629d6116cf6
Linux patch: 6.12.111
Linux 3.16.72 <3.17
Linux b98749cac4a695f084a5ff076f4510b23e353ecd <dfe7b750c7e069873a8a57a11c816831a235618a
Linux b98749cac4a695f084a5ff076f4510b23e353ecd <9f2e63f1b2d5fc5b5423424902c091123e220e7e
Linux 4.14.114 <4.15
Linux 5.0.10 <5.1
Linux patch: 7.2.7
Linux b98749cac4a695f084a5ff076f4510b23e353ecd <2ed2c29dd9593637cfa25ac1eb23241b20202778
Linux ebac4d0adf68f8962bd82fcf483936edd6ec095b
Linux 4.19.37 <4.20
Linux 4.9.171 <4.10
Linux 1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12
Linux patch: 6.18.53
Linux patch: 7.3-rc3
Linux 8092ecc306d81186a64cda42411121f4d35aaff4
Linux 2429fcf06d3cb962693868ab0a927c9038f12a2d
Linux 53fc31a4853e30d6e8f142b824f724da27ff3e40

Affected Packages

euvd linux fix: 3.17, 4.10, 4.15, 4.20, 5.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the Linux kernel SMB/CIFS client implemented under fs/smb/client (historically fs/cifs), which mounts Windows/Samba shares via the CIFS protocol. Cache coherency in SMB is managed through oplocks (opportunistic locks): when the server needs to revoke a client's oplock, it sends an oplock-break message, and the client schedules asynchronous work via cifs_queue_oplock_break() to process it. In the vulnerable code, cifs_queue_oplock_break() unconditionally increments the reference count on the target cifsFileInfo before calling queue_work(); only the queued work item later calls _cifsFileInfo_put() to release that reference. Because queue_work() returns false (and silently does nothing) when an identical work item is already pending on the workqueue, a second oplock break arriving during that window leaks the reference permanently. The missing release is a classic reference-count / resource-management defect (in CWE terms, improper resource lifetime handling such as CWE-772/CWE-911 class). The fix moves the reference increment so it only occurs after queue_work() succeeds, which the commit notes is safe because all three call sites hold tcon->open_file_lock across the call and _cifsFileInfo_put() decrements the same counter under that lock. CPE data identifies the affected product as the Linux kernel (cpe:2.3:a:linux:linux), with the vulnerable code tracing back to the CIFS client and affecting a broad range of long-term and stable kernel branches, from the 3.16/4.x era up through current 6.x and 7.x releases.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.3 MEDIUM

Server-triggered against the client (AV:N) but timing-race dependent on a slow-response window (AC:H) and requires the share to be mounted (PR:L); availability-only crash (C:N/I:N/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Sep 25, 2026 - 11:02 EUVD
CVE Published
Sep 25, 2026 - 10:21 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 25, 2026 - 10:21 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid leaking refcount in cifs_queue_oplock_break()

cifs_queue_oplock_break() unconditionally takes a reference on the target file before queueing cifs_oplock_break(). Only that work item decreases the reference counter again.

If another oplock break arrives while that work is still queued, queue_work() will return false and not queue this second work item. As a result, we will never reach the point to drop the file reference again and are leaking this reference. This can be triggered when interacting with a slow-responding server.

As a result, later unmount operations for this file system will fail with

BUG: Dentry ... still in use (1) [unmount of cifs cifs] VFS: Busy inodes after unmount of cifs (cifs) kernel BUG at fs/super.c:777!

Fix this by only incrementing the reference count if the work has been queued successfully. Taking it after queue_work() is safe because all three callers hold tcon->open_file_lock across the call and _cifsFileInfo_put() decrements under that same lock, so a worker that starts the handler in the window cannot drop the reference before it has been taken.

Executive ViewAI

Why It Matters

A reference-counting defect in the Linux kernel's CIFS/SMB client can prevent affected servers and workstations from cleanly unmounting network file shares and can escalate to a kernel crash, degrading availability on those hosts. The exposure is narrow: it requires a user with mount privileges to connect to an SMB share hosted on a server the attacker controls or that responds slowly, so risk is concentrated in environments where staff or systems routinely mount third-party or untrusted SMB shares. Because the impact is availability-only and the preconditions are non-trivial, leadership should treat this as a scoped operational risk requiring scheduled kernel maintenance rather than an emergency incident.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 53% exploitable
Prevalence
Medium
CIFS client ubiquitous in kernel but only affects hosts mounting SMB shares
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Low

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97557 REF https://git.kernel.org/stable/c/2ed2c29dd9593637cfa25ac1eb23241b20202778 REF https://git.kernel.org/stable/c/735a3a610136ae10f381d0909dff38e5b5c5f056 REF https://git.kernel.org/stable/c/9f2e63f1b2d5fc5b5423424902c091123e220e7e REF https://git.kernel.org/stable/c/af0193bbf1ac8c0f67f972998b0cc629d6116cf6 REF https://git.kernel.org/stable/c/de2a6bcff2659bea40c7485115b57f0ae189fc01 REF https://git.kernel.org/stable/c/dfe7b750c7e069873a8a57a11c816831a235618a

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy