CVE-2026-97558 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems who may be affected by this vulnerability, should assess their exposure and apply the provided patches to mitigate the issue.

Why it matters

This vulnerability in the Linux kernel can lead to resource leaks and potential denial of service if not properly mitigated. Linux kernel developers, maintainers, and users of Linux-based systems should assess their exposure and apply the provided patches.

• Potential denial of service due to resource leaks.
• Possible data integrity issues if the leaked resources are used improperly.
• Increased risk of privilege escalation if an attacker can exploit the vulnerability to gain elevated access.
• Verification of patch application and system configuration is necessary to ensure mitigation.

Technical summary

The vulnerability involves a reference leak in the deferred close mechanism for SMB clients in the Linux kernel. When cifs_close() defers a close, it transfers the cifsFileInfo reference to queued work. However, if the work is requeued while still pending, the cifsFileInfo count remains pinned, leading to leaks of its tlink, dentry, and server handle. The fix ensures that the reference is dropped appropriately based on the return value of queue_delayed_work().

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided in the source references to ensure the vulnerability is fixed.
• Verify that the Linux kernel version in use is not affected by this vulnerability.
• Monitor system logs for any suspicious activity related to SMB client operations.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Three source references from the Linux kernel Git repository are provided, detailing the patches applied to resolve the issue. The vulnerability involves a reference leak in the deferred close mechanism for SMB clients in the Linux kernel. When cifs_close() defers a close, it transfers the cifsFileInfo reference to queued work. However, if the work is requeued while still pending, the cifsFileInfo count remains pinned, leading to leaks of its tlink, dentry, and server.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.