CVE-2026-98449: smb: client: delete compound mids on send failure before unlock
In the Linux kernel, the following vulnerability has been resolved:
smb: client: delete compound mids on send failure before unlock
When sending a compound request fails, smbsendrqst() kicks off a reconnect. compoundsendrecv() still has those mids on pendingmidq, but it unlocks the server without removing them first.
During reconnect, cifsabortconnection() walks pendingmidq and runs each mid callback. With no response yet, those callbacks return credits and drop inflight. Then compoundsendrecv()'s send-error path returns the same credits again. inflight ends up decremented twice and smb2addcredits() WARNs.
syzbot hits this during SMB2negotiate when the socket send fails.
cifscallasync() already calls deletemid() before unlock on send failure. Do the same for compound chains and set cancelledmid[] so the out: path does not delete them again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.117 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.61 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.9
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
A compound SMB client request must encounter a socket send failure. The documented reproducer condition occurred during SMB2 negotiation when the socket send failed, causing reconnect handling to process still-pending compound request IDs.
What is the observed impact when it is triggered?
Credits can be returned twice and the in_flight count can be decremented twice. This causes smb2_add_credits() to emit a WARN.
How is the issue corrected?
The fix removes compound request IDs from pending_mid_q before unlocking after a send failure, matching the existing asynchronous-call behavior. It also marks cancelled_mid[] so later cleanup does not try to delete those request IDs again.