CVE-2026-23230

smb: client: split cached_fid bitfields to avoid shared-byte RMW races

Published Feb 18, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: split cached_fid bitfields to avoid shared-byte RMW races

is_open, has_lease and on_list are stored in the same bitfield byte in
struct cached_fid but are updated in different code paths that may run
concurrently. Bitfield assignments generate byte read–modify–write
operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can
restore stale values of the others.

A possible interleaving is:
CPU1: load old byte (has_lease=1, on_list=1)
CPU2: clear both flags (store 0)
CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits

To avoid this class of races, convert these flags to separate bool
fields.

Analysis

Technical impact

The flaw arises from storing several flag bits in a single byte of the cached_fid structure within the Linux SMB client. Concurrent code paths modify these bits separately, causing read‑modify‑write races that can inadvertently restore stale flag values. This race can leave the SMB client in an incorrect, inconsistent state, leading to data corruption, service interruption, or loss of synchronization with the SMB server.

Affected Systems

All Linux kernel releases that include the unpatched SMB client implementation. No specific version range is listed, but any kernel that has not incorporated the latest commit that splits the bitfields into individual boolean members is vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires concurrent execution of the conflicting code paths in the SMB client, typically achievable by a local user with permissions to run SMB client operations. While it does not provide arbitrary code execution, the race condition can disrupt client operations and degrade service availability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ebe98f1447bbccf8228335c62d86af02a0ed23f7`	affected	< 569fecc56bfe4df66f05734d67daef887746656b
`ebe98f1447bbccf8228335c62d86af02a0ed23f7`	affected	< 4386f6af8aaedd0c5ad6f659b40cadcc8f423828
`ebe98f1447bbccf8228335c62d86af02a0ed23f7`	affected	< 3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a
`ebe98f1447bbccf8228335c62d86af02a0ed23f7`	affected	< c4b9edd55987384a1f201d3d07ff71e448d79c1b
`ebe98f1447bbccf8228335c62d86af02a0ed23f7`	affected	< 4cfa4c37dcbcfd70866e856200ed8a2894cac578
`ebe98f1447bbccf8228335c62d86af02a0ed23f7`	affected	< ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241

Linux

affected

Version	Status	Constraints
`6.1`	affected	—
`0`	unaffected	< 6.1
`6.1.164`	unaffected	≤ 6.1.*
`6.6.125`	unaffected	≤ 6.6.*
`6.12.72`	unaffected	≤ 6.12.*
`6.18.11`	unaffected	≤ 6.18.*
`6.19.1`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4386f6af8aaedd0c5ad6f659b40cadcc8f423828)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c4b9edd55987384a1f201d3d07ff71e448d79c1b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4cfa4c37dcbcfd70866e856200ed8a2894cac578)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.6.125,6.7.0)`	unaffected	semver	—
`[6.12.72,6.13.0)`	unaffected	semver	—
`[6.18.11,6.19.0)`	unaffected	semver	—
`[6.19.1,6.20.0)`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that splits the cached_fid bitfield into separate boolean fields, as provided in the commit referenced by the CVE advisory.
If an immediate kernel update is not feasible, disable or restrict SMB client usage on the affected systems until the patch is applied to prevent the race condition from being triggered.
When a kernel upgrade cannot be performed immediately, isolate impacted workloads from external SMB traffic and monitor for anomalous SMB activity until the patch is applied.

Generated by OpenCVE AI on April 15, 2026 at 17:03 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.278% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
https://git.kernel.org/stable/c/3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a
https://git.kernel.org/stable/c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828
https://git.kernel.org/stable/c/4cfa4c37dcbcfd70866e856200ed8a2894cac578
https://git.kernel.org/stable/c/569fecc56bfe4df66f05734d67daef887746656b
https://git.kernel.org/stable/c/c4b9edd55987384a1f201d3d07ff71e448d79c1b
https://git.kernel.org/stable/c/ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241
https://lore.kernel.org/linux-cve-announce/2026021808-CVE-2026-23230-8d0e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23230
https://www.cve.org/CVERecord?id=CVE-2026-23230

History

Oct 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 2, 2026 2:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Apr 15, 2026 5:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Apr 2, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Mar 17, 2026 9:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Feb 23, 2026 3:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241

Feb 19, 2026 4:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/569fecc56bfe4df66f05734d67daef887746656b

Feb 19, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021808-CVE-2026-23230-8d0e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23230 https://www.cve.org/CVERecord?id=CVE-2026-23230
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Feb 18, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old \| IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.
Title		smb: client: split cached_fid bitfields to avoid shared-byte RMW races
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a https://git.kernel.org/stable/c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828 https://git.kernel.org/stable/c/4cfa4c37dcbcfd70866e856200ed8a2894cac578 https://git.kernel.org/stable/c/c4b9edd55987384a1f201d3d07ff71e448d79c1b