{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23230", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.988Z", "datePublished": "2026-02-18T14:53:34.078Z", "dateUpdated": "2026-08-05T12:20:46.650Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:46.650Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: split cached_fid bitfields to avoid shared-byte RMW races\n\nis_open, has_lease and on_list are stored in the same bitfield byte in\nstruct cached_fid but are updated in different code paths that may run\nconcurrently. Bitfield assignments generate byte read–modify–write\noperations (e.g. `orb $mask, addr` on x86_64), so updating one flag can\nrestore stale values of the others.\n\nA possible interleaving is:\n CPU1: load old byte (has_lease=1, on_list=1)\n CPU2: clear both flags (store 0)\n CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits\n\nTo avoid this class of races, convert these flags to separate bool\nfields." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerability is in the SMB client code (fs/smb/client/). The race is triggered between processing a server's create response (setting is_open) and the server sending a lease break notification. A malicious SMB server can trigger this remotely over the network.\nAC:L - The attacker (malicious SMB server) controls when lease breaks are sent and can time them immediately after the create response. The attacker can retry many times across many directory opens, and the RMW race window is inherent to every bitfield write, making it reliably triggerable.\nPR:N - The attacker is the SMB server, requiring no privileges on the victim system. The lease break is processed as part of normal SMB protocol handling with no additional authentication check beyond the existing session.\nUI:R - The victim must mount an SMB share from the attacker's server (or a compromised server), which requires explicit user or administrator action.\nS:U - The vulnerability impacts the kernel where the SMB client runs; it does not cross a security boundary such as a VM or sandbox.\nC:H - The race can restore has_lease after the lease reference was dropped, leading to reference count corruption and use-after-free. UAF on heap objects gives the attacker read primitives over arbitrary kernel memory through heap spraying.\nI:H - The use-after-free from reference count corruption allows the attacker to reclaim the freed cached_fid object with controlled data, enabling arbitrary kernel write primitives and potential code execution.\nA:H - The reference count corruption and list corruption caused by the restored stale flags will lead to double-free, use-after-free, or list corruption, all of which reliably cause kernel panics/oops." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/client/cached_dir.h" ], "versions": [ { "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7", "lessThan": "569fecc56bfe4df66f05734d67daef887746656b", "status": "affected", "versionType": "git" }, { "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7", "lessThan": "4386f6af8aaedd0c5ad6f659b40cadcc8f423828", "status": "affected", "versionType": "git" }, { "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7", "lessThan": "3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a", "status": "affected", "versionType": "git" }, { "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7", "lessThan": "c4b9edd55987384a1f201d3d07ff71e448d79c1b", "status": "affected", "versionType": "git" }, { "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7", "lessThan": "4cfa4c37dcbcfd70866e856200ed8a2894cac578", "status": "affected", "versionType": "git" }, { "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7", "lessThan": "ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/client/cached_dir.h" ], "versions": [ { "version": "6.1", "status": "affected" }, { "version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.164", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.125", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.72", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.11", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.164" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.125" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.72" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.19.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/569fecc56bfe4df66f05734d67daef887746656b" }, { "url": "https://git.kernel.org/stable/c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828" }, { "url": "https://git.kernel.org/stable/c/3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a" }, { "url": "https://git.kernel.org/stable/c/c4b9edd55987384a1f201d3d07ff71e448d79c1b" }, { "url": "https://git.kernel.org/stable/c/4cfa4c37dcbcfd70866e856200ed8a2894cac578" }, { "url": "https://git.kernel.org/stable/c/ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241" } ], "title": "smb: client: split cached_fid bitfields to avoid shared-byte RMW races", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:01:05.733Z" }, "affected": [ { "vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [ { "status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" } ] } ] } }