UBUNTU-CVE-2026-98450: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle. The earlier mid is then released without invoking handlecancelledmid(), leaving the remote handle open because no FID was copied to the caller. Mark completed earlier mids as cancelled when a compound wait or MID synchronization aborts. Keep their response buffers attached while the MIDs are synchronized, and transfer them only after synchronization of the processed responses, so the release path can inspect successful CREATE responses and queue SMB2close() after a later failure. Account for a remote open only after the close work is allocated and before it is queued, since the caller has not yet updated numremoteopens. Mark the create+close compound used by smb2unlink() so it is not closed again. Non-CREATE responses and compounds that already include a close keep their existing behavior.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the affected Ubuntu Linux kernel variants and making SMB client compound requests are exposed. The issue concerns remote SMB handles opened by earlier CREATE operations when a later response wait or MID synchronization fails.
What conditions are needed to trigger it?
An attacker or failure condition must cause a compound SMB request to abort during response waiting or MID synchronization after an earlier CREATE has already succeeded. The local caller must have low privileges; no user interaction is required.
What is the impact if exploitation succeeds?
A successfully opened remote SMB handle can be left open because its file identifier is not returned to the caller and the client does not send the required SMB2 close. The listed impact is limited to availability.
How does the fix prevent the leaked remote handle?
The fix marks completed earlier requests as cancelled when compound processing aborts, preserving their responses until synchronization completes. This lets the release path identify successful CREATE responses and queue an SMB2 close, while avoiding an extra close for compounds that already include one.