CVE-2026-98439 smb/server: cancel async requests when closing connection
An attacker can cause a denial of service by preventing SMB connections from closing properly due to uncancelled async requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98439?
CVE-2026-98439 is a denial of service vulnerability in Linux, published on 18 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb/server: cancel async requests when closing connection
An async request may still be waiting when a connection is closed. This can stop the connection from closing.
Cancel active async requests before waiting for them to finish.
Which versions are affected by CVE-2026-98439?
How do I fix CVE-2026-98439?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98439 being exploited?
There is no known exploitation of CVE-2026-98439 in the wild and no public exploit code.
Sources
Also known as AZL-109275, BELL-CVE-2026-98439, DEBIAN-CVE-2026-98439, GHSA-xm6x-r8m7-4r79, UBUNTU-CVE-2026-98439.