CVE-2026-97556

A flaw was found in the Linux kernel's SMB client. This vulnerability can lead to a denial of service (DoS) on systems using multi-user CIFS mount configurations. When processing an opportunistic lock (oplock) break, an error during tree link lookup prevents the client from releasing an acquired file reference count. A local user can trigger this condition, leaving filesystem resources marked as busy and causing the kernel to crash when the filesystem is unmounted.

A low impact reference count leak was found in the Linux kernel SMB client (CIFS) in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL 9 based CoreOS kernel used by Red Hat OpenShift Container Platform 4.16 and later. When a CIFS filesystem is mounted with the multiuser option and cifs_sb_tlink() fails while an opportunistic lock (oplock) break is being processed, cifs_oplock_break() returns without releasing the file reference it acquired. A local user with access to such a multiuser CIFS mount could trigger this condition, leaving inodes and dentries busy and causing a kernel crash (VFS 'Busy inodes' BUG) when the filesystem is unmounted, resulting in local denial of service. Because exploitation requires the uncommon multiuser CIFS mount configuration combined with a tree connect lookup failure, Red Hat assesses the overall impact as low despite the high availability component of the CVSS:3.1 vector. Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 kernel and kernel-rt streams, and OpenShift 4.12 through 4.15 are not affected because the vulnerable code is not present in those kernels. For the affected streams, the fix is deferred: the issue is a local denial of service with limited practical exploitability, and the residual risk is that a system using multiuser CIFS mounts may fail to unmount the filesystem or crash when it is unmounted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code path is reachable only on CIFS mounts configured with the multiuser option. Where feasible, mount CIFS shares without the multiuser option (for example, using a single set of mount credentials) to avoid the affected path, and restrict local access on systems that must use multiuser CIFS mounts. For the affected Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams, the fix is deferred and will be delivered in a future update; no fixed version is currently available.