CVE-2026-97558

A flaw was found in the Linux kernel's SMB (Server Message Block) client subsystem, which can lead to a Denial of Service (DoS). Due to a timing issue during deferred file close operations, the kernel fails to properly release an internal file reference count when background cleanup work is already pending. A local user performing file operations on an SMB share can trigger this race condition, causing file structures and server handles to remain pinned in memory. Over time, this resource leak can exhaust kernel memory and disrupt system availability.

A denial-of-service flaw rated moderate by Red Hat was found in the Linux kernel's SMB client subsystem in its deferred close handling. When cifs_close() defers a close while the deferred workqueue callback is running, a race condition can leave the work pending with its scheduling flag cleared; a later open and close that reuses the handle then fails to queue the deferred work and returns without dropping the closing file's cifsFileInfo reference. A local user able to perform open and close operations on files on a mounted SMB share can repeatedly trigger this race, keeping kernel file structures, tlink, dentry, and server handles pinned in memory. Over time this resource leak can exhaust kernel memory and disrupt system availability; there is no impact on confidentiality or integrity.

Red Hat Enterprise Linux 6 ELS, Red Hat Enterprise Linux 7 ELS, and Red Hat Enterprise Linux 8 (including its kernel and kernel-rt streams) are not affected because the vulnerable code is not present in those kernels. Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipped with RHEL CoreOS 9 are affected. For these affected products the fix is deferred to a future scheduled update because this is a narrow timing-window resource leak rather than memory corruption, and its practical impact is limited to gradual resource exhaustion on systems performing intensive SMB client file operations. The residual risk until the fix is delivered is denial of service through accumulated kernel memory consumption on such systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.