Skip to content
fr Sign in
8.8 High

CVE-2026-23230 In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid…

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.

Affected products and versions

Product Affected versions Fixed in
Linux 7.0 earliest → < 7.0 7.0
Linux 6.19 earliest → < 6.19.1 6.19.1
Linux 6.18 earliest → < 6.18.11 6.18.11
Linux 6.12 earliest → < 6.12.72 6.12.72
Linux 6.6 earliest → < 6.6.125 6.6.125
Linux 6.1 6.1.164
RUGGEDCOM RST2428P 4.0 earliest → < 4.0 4.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Linux

The 18283 CVEs of Linux →
CVE-2026-99270 In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler() 8.1 High CVE-2026-99269 In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before… 7.8 High CVE-2026-99261 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for… Not rated CVE-2026-99260 In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags… Not rated
Track this CVE