CVE-2026-97557 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using SMB client implementations, should assess exposure and prioritize patching. This includes system administrators, security teams, and Linux kernel maintainers.

Why it matters

A vulnerability in the Linux kernel's SMB client implementation can cause a reference count leak, leading to failed unmount operations. Defenders should prioritize verifying and applying patches, particularly in environments where SMB client interactions with slow-responding servers are common.

• Verify and apply patches to prevent reference count leaks
• Monitor for failed unmount operations due to reference count leaks
• Update SMB client configurations to handle slow-responding servers

Technical summary

The cifs_queue_oplock_break() function in the Linux kernel's SMB client implementation has a reference count leak vulnerability. This occurs when a second oplock break arrives while the first work item is still queued, preventing the reference count from being decremented. The issue can be triggered by interacting with a slow-responding server, leading to failed unmount operations. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly in environments where SMB client interactions with slow-responding servers are common. The vulnerability can cause reference count leaks, leading to failed unmount operations. This issue arises from the c

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly in environments where SMB client interactions with slow-responding servers are common.

Recommended defensive actions

• Verify and apply patches for Linux kernel versions affected by this vulnerability
• Review and update SMB client configurations to handle slow-responding servers
• Monitor for and respond to potential failed unmount operations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected products. The Linux kernel project has resolved this issue through a patch that modifies the cifs_queue_oplock_break() function to only increment the reference count if the work has been queued successfully.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.