{"id":"CVE-2026-98452","published":"2026-10-18T16:16:55.537","lastModified":"2026-10-19T10:18:54.437","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clean up failed cached directory opens\n\nopen_cached_dir() sends CREATE and QUERY_INFO as a compound request. If\nthe CREATE succeeds but a later command returns an error, the function\nmust retain the CREATE FID so common cleanup can issue SMB2_close(). It\nalso must not treat a response error as a valid CREATE.\n\nValidate the CREATE response before using its fields, record the FIDs, and\nmark the handle open before handling errors from later compound commands.\nMove the -EREMCHG reconnect handling before response validation so a\nmissing response does not hide the reconnect request. Count the handle\nwhen it is marked open; confirmed close responses decrement the counter,\nwhile existing close retry behavior remains best effort on transport\nfailures.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/48958ddda3d7eee3600261e2d90671f63e055dc4","tags":[]},{"url":"https://git.kernel.org/stable/c/7c1509598a4fdfb54cb09ce33e4405bd6dbd8295","tags":[]},{"url":"https://git.kernel.org/stable/c/abab661eed00fa102d3c35ddf1cce4f687e718c1","tags":[]},{"url":"https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}