# CVE-2026-98897: ksmbd: don't hold ci->m_lock while waiting for a lease break ack


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 23 Oct 2026
- **Updated:** 26 Oct 2026
- **Also known as:** AZL-110573, BELL-CVE-2026-98897, DEBIAN-CVE-2026-98897, GHSA-83j5-g9m2-9mf4, UBUNTU-CVE-2026-98897

## What is CVE-2026-98897?

CVE-2026-98897 is a vulnerability in Linux, published on 23 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: don't hold ci->m_lock while waiting for a lease break ack

When a cifs.ko client caches a read-handle (RH) lease via deferred close
and a conflicting open arrives, ksmbd breaks the lease and waits for the
acknowledgment in wait_for_break_ack() for up to OPLOCK_WAIT_TIME (35s).
__smb_break_all_levII_oplock() runs that wait while holding ci->m_lock
for read.

cifs.ko reacts to a handle-lease break by closing the deferred handle
rather than sending a lease break acknowledgment. That close path
(close_id_del_oplock() -> opinfo_del()) takes ci->m_lock for write and
is exactly what would wake the waiter, but it blocks on the read lock
held by the waiting thread. The break is then resolved only by the 35s
timeout, so xfstests generic/001 takes ~78s with leases enabled versus
~4s with oplocks only.

Collect the target opinfos (each pinned with a reference) while holding
ci->m_lock, then break them after releasing it, matching how
smb_grant_oplock() already breaks a conflicting lease using only a
reference.  The reference keeps the opinfo (and its conn and lease)
alive across the unlocked window, and a close racing the break is
handled by the existing OPLOCK_CLOSING state check. Apply the same fix
to the parent lease break paths.

## Which versions are affected by CVE-2026-98897?


## How do I fix CVE-2026-98897?

Upgrade to a fixed version.

## Is CVE-2026-98897 being exploited?

There is no known exploitation of CVE-2026-98897 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98897 and fix it if it is affected.

What it is: CVE-2026-98897 is a vulnerability in Linux, published on 23 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-98897 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98897/ (Markdown: https://insights.sbomify.com/CVE-2026-98897/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98897
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98897
- OSV: https://osv.dev/vulnerability/CVE-2026-98897

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98897/
Summaries are generated and may contain mistakes; the official description above is the record.