CVE-2026-23230

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability is caused by a race condition during concurrent updates to internal flags, which can lead to stale data being restored. A remote attacker with low privileges could exploit this, potentially causing unexpected behavior or a denial of service in the SMB client.

A moderate impact flaw was found in the Linux kernel's Server Message Block (SMB) client in Red Hat Enterprise Linux. The is_open, has_lease, and on_list flags of struct cached_fid were packed into a single bitfield byte while being updated by different code paths that may run concurrently. Because bitfield writes compile to byte-wide read-modify-write operations, an update performed by one CPU can restore stale values of flags that another CPU has already cleared, reintroducing inconsistent cached file-handle state in the SMB client's directory cache and lease handling. A remote attacker with low privileges able to influence concurrent SMB client operations could trigger this race, causing unexpected behavior or a denial of service in the SMB client. Red Hat rated this flaw as moderate (CVSS 6.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerable code is present in the affected RHEL 9 (kernel and kernel-rt) and RHEL 10 (kernel) update streams; fixes are currently deferred on the in-support affected update streams, consistent with the moderate impact rating and the fact that this is a timing-dependent state-consistency race without memory-safety consequences. The residual risk of the deferral is intermittent inconsistent SMB client cached state and potential denial of service of SMB mounts. The affected RHEL 9.0 and 9.7 update streams are out of support scope. RHEL 6, 7, and 8, Red Hat In-Vehicle OS 2.0, and the newest RHEL 9 and RHEL 10 minor releases are not affected because the vulnerable code is not present. The CVE.org record scores this flaw as important (CVSS 8.8); Red Hat's assessment differs because the realistic worst-case impact is corruption of the SMB client's cached state and denial of service rather than the high confidentiality and integrity impact implied by the upstream vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upgrading to a release that contains the fix is the available remediation; the corrected cached_fid flag handling is already included in the newest RHEL 9 and RHEL 10 minor releases, which are marked not affected.