CVE-2026-98174 smb: client: fix rlist race and missing initialization
A race condition and missing initialization in the Linux kernel SMB client can lead to list corruption and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-98174?
CVE-2026-98174 is a high-severity vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix rlist race and missing initialization
TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_empty() always return false and list_add() dereference a NULL ->prev pointer.
Also, cifs_signal_cifsd_for_reconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.
Which versions are affected by CVE-2026-98174?
How do I fix CVE-2026-98174?
Apply the vendor's patch.
Is CVE-2026-98174 being exploited?
There is no known exploitation of CVE-2026-98174 in the wild and no public exploit code.
Sources
Also known as AZL-106391, BELL-CVE-2026-98174, DEBIAN-CVE-2026-98174, GHSA-f559-3m6w-qcp7, UBUNTU-CVE-2026-98174.