CVE-2026-43239

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A race condition exists where multiple operations attempting to update network interfaces could execute simultaneously. This concurrency issue could lead to an inconsistent state within the SMB client, potentially causing system instability or a denial of service (DoS).

A MODERATE severity race condition was found in the Linux kernel's SMB client, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10. The SMB client's network interface query path did not adequately synchronize its update timestamp, so two query interface work items could run concurrently and update interface state at the same time. This could leave the SMB client in an inconsistent state, potentially causing system instability or a denial of service. Triggering the race generally requires local access to an SMB mount or client paths that schedule interface query work, and exploitation depends on precise timing; the impact is limited to availability, with no supported evidence of memory corruption, information disclosure, or privilege escalation. Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat In-Vehicle OS 2 are not affected because the vulnerable code is not present in those products. Red Hat rated this flaw lower than upstream: Red Hat assessed MODERATE severity with a local attack vector and high attack complexity (CVSS 6.5), while the upstream CVE record assigns a CVSS score of 8.8 with a network vector, because this issue is not a simple unauthenticated network trigger and its practical impact is limited to availability. For in-support affected streams the fix is deferred given the low practical security impact of the race; the residual risk is intermittent SMB client instability or redundant concurrent interface updates. Several affected update streams are out of active support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.