CVE-2026-98172
kernel: smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 6, 2026
Updated · October 7, 2026
Description
A flaw was found in the Linux kernel's Server Message Block (SMB) client subsystem. When establishing a Remote Direct Memory Access (RDMA) session, an error during session initialization can cause the cleanup routine to release the session structure without first terminating the active RDMA connection. This issue leads to a kernel resource and memory leak, which can be triggered repeatedly to cause system resource exhaustion and a Denial of Service (DoS).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 · Missing Release of Resource after Effective Lifetime