CVE-2026-98172 smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
A memory leak in the Linux kernel SMB client allows remote attackers to cause denial of service by triggering connection errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98172?
CVE-2026-98172 is a denial of service vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g. kthread_create() returns an error), the error path frees tcp_ses without first destroying the smbd_connection.
Fix this by calling smbd_destroy() in the out_err cleanup path before kfree(tcp_ses). smbd_destroy() safely handles the case where smbd_conn is NULL, so it can be called unconditionally.
Which versions are affected by CVE-2026-98172?
How do I fix CVE-2026-98172?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98172 being exploited?
There is no known exploitation of CVE-2026-98172 in the wild and no public exploit code.
Sources
Also known as AZL-106104, BELL-CVE-2026-98172, DEBIAN-CVE-2026-98172, GHSA-h5hv-w97x-4565, UBUNTU-CVE-2026-98172.