UBUNTU-CVE-2026-98172: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession() error When an RDMA connection is successfully established via smbdgetconnection() but cifsgettcpsession() later fails (e.g. kthreadcreate() returns an error), the error path frees tcpses without first destroying the smbdconnection. Fix this by calling smbddestroy() in the outerr cleanup path before kfree(tcpses). smbddestroy() safely handles the case where smbdconn is NULL, so it can be called unconditionally.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Call smbd_destroy() unconditionally in the out_err cleanup path before kfree(tcp_ses) when cifs_get_tcp_session() fails after an RDMA connection is established.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the affected Ubuntu kernel packages are exposed when the SMB client establishes an RDMA connection and then encounters a failure while creating the associated TCP session. The listed packages include standard Ubuntu kernels and Azure, GCP, AWS FIPS, FIPS, and realtime variants.
What conditions are required to trigger the leak?
An RDMA SMB connection must be successfully created through smbd_get_connection(), followed by a failure in cifs_get_tcp_session(). One example given is kthread_create() returning an error during TCP-session setup.
What is the impact if the condition occurs?
The error path frees the TCP session without first destroying the established smbd_connection, causing an smbd_connection resource leak. The resolved code destroys that connection during cleanup before freeing the TCP session.