Riskcovery

CVE-2026-97557

smb: client: avoid leaking refcount in cifs_queue_oplock_break()

State
Published
Severity
7.5 High
Published
Sep 25, 2026
Updated
Oct 30, 2026
Reserved
Sep 24, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid leaking refcount in cifs_queue_oplock_break()

cifs_queue_oplock_break() unconditionally takes a reference on the target file before queueing cifs_oplock_break(). Only that work item decreases the reference counter again.

If another oplock break arrives while that work is still queued, queue_work() will return false and not queue this second work item. As a result, we will never reach the point to drop the file reference again and are leaking this reference. This can be triggered when interacting with a slow-responding server.

As a result, later unmount operations for this file system will fail with

BUG: Dentry ... still in use (1) [unmount of cifs cifs] VFS: Busy inodes after unmount of cifs (cifs) kernel BUG at fs/super.c:777!

Fix this by only incrementing the reference count if the work has been queued successfully. Taking it after queue_work() is safe because all three callers hold tcon->open_file_lock across the call and _cifsFileInfo_put() decrements under that same lock, so a worker that starts the handler in the window cannot drop the reference before it has been taken.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b98749cac4a695f084a5ff076f4510b23e353ecd to before 13b9519b19e6e58a6cd01e63062cd1da7bd6449aAffected
  • b98749cac4a695f084a5ff076f4510b23e353ecd to before 0fb92ac85db58945ad7b970ff17674001487b3a3Affected
  • b98749cac4a695f084a5ff076f4510b23e353ecd to before 735a3a610136ae10f381d0909dff38e5b5c5f056Affected
  • b98749cac4a695f084a5ff076f4510b23e353ecd to before de2a6bcff2659bea40c7485115b57f0ae189fc01Affected
  • b98749cac4a695f084a5ff076f4510b23e353ecd to before af0193bbf1ac8c0f67f972998b0cc629d6116cf6Affected
  • b98749cac4a695f084a5ff076f4510b23e353ecd to before 2ed2c29dd9593637cfa25ac1eb23241b20202778Affected
  • b98749cac4a695f084a5ff076f4510b23e353ecd to before dfe7b750c7e069873a8a57a11c816831a235618aAffected
  • b98749cac4a695f084a5ff076f4510b23e353ecd to before 9f2e63f1b2d5fc5b5423424902c091123e220e7eAffected
  • 2429fcf06d3cb962693868ab0a927c9038f12a2dAffected
  • 1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12Affected
  • 53fc31a4853e30d6e8f142b824f724da27ff3e40Affected
  • 8092ecc306d81186a64cda42411121f4d35aaff4Affected
  • ebac4d0adf68f8962bd82fcf483936edd6ec095bAffected
  • 3.16.72 to before 3.17Affected
  • 4.9.171 to before 4.10Affected
  • 4.14.114 to before 4.15Affected
  • 4.19.37 to before 4.20Affected
  • 5.0.10 to before 5.1Affected
LinuxLinux
  • 5.1Affected
  • before 5.1Not affected
  • 5.10.273 through 5.10.*Not affected
  • 5.15.224 through 5.15.*Not affected
  • 6.1.189 through 6.1.*Not affected
  • 6.6.158 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.