Executive brief
A vulnerability in the Linux kernel's SMB client could allow for data corruption or system instability. The issue stems from how the system tracks file and directory states when communicating with network storage. If exploited, this could lead to unauthorized data modification or service disruptions on systems that use SMB for network file sharing.
Technical details
A race condition exists in the Linux kernel SMB client (cifs) due to the use of bitfields in 'struct cached_fid'. The flags 'is_open', 'has_lease', and 'on_list' are stored within the same byte, leading to non-atomic read-modify-write (RMW) operations when updated from concurrent code paths. An attacker or a specific sequence of network events could cause one CPU to overwrite flag updates from another CPU, potentially reintroducing stale state information. This can result in inconsistent file states, memory corruption, or kernel panics. The vulnerability has been addressed by converting these bitfields into separate boolean fields to ensure atomic updates.
Affected products
- Linux Linux Kernel 6.1 to 6.1.164, 6.2 to 6.6.125, 6.7 to 6.12.72, 6.13 to 6.18.11, 6.19 to 6.19.1
Timeline
- 2026-02-18: disclosed
- 2026-02-18: advisory
- 2026-01-27: patched
References
- https://git.kernel.org/stable/c/3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a
- https://git.kernel.org/stable/c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828
- https://git.kernel.org/stable/c/4cfa4c37dcbcfd70866e856200ed8a2894cac578
- https://git.kernel.org/stable/c/569fecc56bfe4df66f05734d67daef887746656b
- https://git.kernel.org/stable/c/c4b9edd55987384a1f201d3d07ff71e448d79c1b
- https://git.kernel.org/stable/c/ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html