CVE-2026-98681 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
Concurrent updates to SMB client flags can corrupt state due to race conditions, potentially causing data corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98681?
CVE-2026-98681 is a vulnerability in Linux, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
The invalidHandle, swapfile, oplock_break_cancelled, offload, and status_file_deleted fields are stored in the same bitfield byte in struct cifsFileInfo, but are updated in different code paths that may run simultaneously, and are protected by different locks. Since bitfield assignments generate byte-level read-modify-write operations, a modification to one flag can overwrite a concurrent modification to another flag.
To avoid these races, convert these flags from a bitfield to separate bool fields.
Which versions are affected by CVE-2026-98681?
How do I fix CVE-2026-98681?
Apply the vendor's patch.
Is CVE-2026-98681 being exploited?
There is no known exploitation of CVE-2026-98681 in the wild and no public exploit code.
Sources
Also known as AZL-109164, BELL-CVE-2026-98681, DEBIAN-CVE-2026-98681, GHSA-f6j4-gqwr-mpr2, UBUNTU-CVE-2026-98681.