CVE-2026-97557

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This flaw allows a remote or slow-responding SMB server to cause a Denial of Service (DoS) through a kernel crash. When handling opportunistic lock (oplock) break requests, the client can leak file reference counters if a new notification arrives while earlier work is still queued. This leaked reference leaves file system structures marked as in use, causing the kernel to crash when unmounting the file system.

A reference leak in cifs_queue_oplock_break occurs when a second oplock break arrives while the first oplock break work item is already queued. queue_work then returns false, but the code has already acquired another cifsFileInfo reference that no worker will release. A slow responding or malicious SMB server may repeatedly create this condition and retain file references until CIFS unmount fails with busy dentries or reaches a kernel BUG path. For the CVSS the PR:N is used because a remote attacker controlling the SMB server does not need local code execution on the client after the client has mounted the attacker controlled share. The issue is network reachable through an active SMB client connection, but requires the victim to use the affected CIFS client against a server controlled or influenced by the attacker. Impact is primarily resource exhaustion and denial of service. Confidentiality and integrity impact are not supported because this patch identifies a leaked reference and does not demonstrate a memory corruption primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.