CVE-2026-97556: smb: client: avoid leaking refcount when cifs_sb_tlink() fails
In the Linux kernel, the following vulnerability has been resolved:
smb: client: avoid leaking refcount when cifssbtlink() fails
cifsoplockbreak() takes over the reference that cifsqueueoplockbreak() acquired when it queued the work, and drops it with cifsFileInfoput() once the break has been processed.
Only in setups with "-o multiuser", cifssbtlink() may fail, at which point cifsoplockbreak() returns without putting the file reference, mirroring the reference leak we already fixed in the companion patch to cifsqueueoplockbreak().
This would trigger a crash due to busy inodes on the next unmount:
BUG: Dentry ... still in use (1) [unmount of cifs cifs] VFS: Busy inodes after unmount of cifs (cifs)
Drop the reference on that path as well. Doing so before the out label mirrors the normal path, which also puts the reference before cifsdoneoplockbreak().
Found by Sashiko code review. The failure path was not exercised at runtime.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.189 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is limited to Linux kernel CIFS/SMB client mounts configured with the -o multiuser mount option. The affected failure path is not applicable to CIFS mounts that do not use multiuser.
What conditions are needed to trigger the problem?
An oplock-break work item must be processed and cifs_sb_tlink() must fail in the multiuser setup. That failure causes a file-reference leak, which can lead to busy inodes and a crash on a subsequent CIFS unmount.
How can administrators identify a likely impact?
A likely symptom is an unmount failure or crash reporting busy CIFS inodes, including messages such as "VFS: Busy inodes after unmount of cifs (cifs)." The problematic failure path was identified by code review and was not exercised at runtime.