01 Record

CVE-2026-97556

smb: client: avoid leaking refcount when cifs_sb_tlink() fails

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

smb: client: avoid leaking refcount when cifs_sb_tlink() fails

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.21% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 11.3% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Received. NVD last modified this record on 2026-10-19.
Red Hat severity: Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-25 10:21Z1 MO AGO

Last updated

2026-10-19 09:09Z10 DAYS AGO

Reserved

2026-09-24

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-911Improper Update of Reference CountBase

Data version

5.2

Document digest

8ee1745022c0c5f41a0f07d53e7fc7b83c1fc49f413d46b84210b6f5dc293f93

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux5ee28bcfbaacf289eb25c662a2862542ea6ce6a7 to < 55c5f095d4df14271b238f826e1392fda7b6e60e, e8f5f849ffce24490eb9449e98312b66c0dba76f to < e9c5bcc88b8337157e480c85a6d2f326bc265012, e8f5f849ffce24490eb9449e98312b66c0dba76f to < 9ec991e148368e3207e98134c509a625097f7693, e8f5f849ffce24490eb9449e98312b66c0dba76f to < dd03fd658ea59821505e0e643b6b7cbdf51c4e1d, e8f5f849ffce24490eb9449e98312b66c0dba76f to < 1d1b0f1d812a4011a57bc6c70492c34a2e46c6dd, e8f5f849ffce24490eb9449e98312b66c0dba76f to < 23b26f4408ac3f35a482d2e5cf6fc865d4201b71, b99f490ea87ebcca3a429fd8837067feb56a4c7c, 6b67a6d2e50634fe127e656147c81915955e9f5e, 6.1.47 to < 6.1.189, 5.15.128 to < 5.16, 6.4.12 to < 6.5, 6.5—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/55c5f095d4df14271b238f826e1392fda7b6e60e
git.kernel.orghttps://git.kernel.org/stable/c/e9c5bcc88b8337157e480c85a6d2f326bc265012
git.kernel.orghttps://git.kernel.org/stable/c/9ec991e148368e3207e98134c509a625097f7693
git.kernel.orghttps://git.kernel.org/stable/c/dd03fd658ea59821505e0e643b6b7cbdf51c4e1d
git.kernel.orghttps://git.kernel.org/stable/c/1d1b0f1d812a4011a57bc6c70492c34a2e46c6dd
git.kernel.orghttps://git.kernel.org/stable/c/23b26f4408ac3f35a482d2e5cf6fc865d4201b71

07 Fixed in

Debian 12

linux
Fixed in 6.1.190-1
linux-6.12
Fixed in 6.12.111-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.111-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.7-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.