UBUNTU-CVE-2026-98449: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smbsendrqst() kicks off a reconnect. compoundsendrecv() still has those mids on pendingmidq, but it unlocks the server without removing them first. During reconnect, cifsabortconnection() walks pendingmidq and runs each mid callback. With no response yet, those callbacks return credits and drop inflight. Then compoundsendrecv()'s send-error path returns the same credits again. inflight ends up decremented twice and smb2addcredits() WARNs. syzbot hits this during SMB2negotiate when the socket send fails. cifscallasync() already calls deletemid() before unlock on send failure. Do the same for compound chains and set cancelledmid[] so the out: path does not delete them again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In compound_send_recv()'s send-error path, mark the affected mids in cancelled_mid[] and delete the compound mids from pending_mid_q before unlocking the server, so the reconnect out: path does not delete them again and in_flight is not decremented twice.