CVE-2026-23230

smb: client: split cached_fid bitfields to avoid shared-byte RMW races

State: Published
Severity: 8.8 High
Published: Feb 18, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: split cached_fid bitfields to avoid shared-byte RMW races

is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others.

A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits

To avoid this class of races, convert these flags to separate bool fields.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 569fecc56bfe4df66f05734d67daef887746656bAffected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 4386f6af8aaedd0c5ad6f659b40cadcc8f423828Affected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 3eaa22d688311c708b73f3c68bc6d0c8e3f0f77aAffected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before c4b9edd55987384a1f201d3d07ff71e448d79c1bAffected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 4cfa4c37dcbcfd70866e856200ed8a2894cac578Affected ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.164 through 6.1.Not affected 6.6.125 through 6.6.Not affected 6.12.72 through 6.12.Not affected 6.18.11 through 6.18.Not affected 6.19.1 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 569fecc56bfe4df66f05734d67daef887746656bAffected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 4386f6af8aaedd0c5ad6f659b40cadcc8f423828Affected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 3eaa22d688311c708b73f3c68bc6d0c8e3f0f77aAffected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before c4b9edd55987384a1f201d3d07ff71e448d79c1bAffected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before 4cfa4c37dcbcfd70866e856200ed8a2894cac578Affected
ebe98f1447bbccf8228335c62d86af02a0ed23f7 to before ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241Affected

LinuxLinux

6.1Affected
before 6.1Not affected
6.1.164 through 6.1.*Not affected
6.6.125 through 6.6.*Not affected
6.12.72 through 6.12.*Not affected
6.18.11 through 6.18.*Not affected
6.19.1 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.