Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-23230

smb: client: split cached_fid bitfields to avoid shared-byte RMW races

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • ebe98f1447bbccf8228335c62d86af02a0ed23f7 to < 569fecc56bfe4df66f05734d67daef887746656baffected
  • ebe98f1447bbccf8228335c62d86af02a0ed23f7 to < 4386f6af8aaedd0c5ad6f659b40cadcc8f423828affected
  • ebe98f1447bbccf8228335c62d86af02a0ed23f7 to < 3eaa22d688311c708b73f3c68bc6d0c8e3f0f77aaffected
  • ebe98f1447bbccf8228335c62d86af02a0ed23f7 to < c4b9edd55987384a1f201d3d07ff71e448d79c1baffected
  • ebe98f1447bbccf8228335c62d86af02a0ed23f7 to < 4cfa4c37dcbcfd70866e856200ed8a2894cac578affected
  • ebe98f1447bbccf8228335c62d86af02a0ed23f7 to < ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241affected

Linux Linux

Default version status: affected

  • 6.1affected
  • 0 to < 6.1unaffected
  • 6.1.164 to ≤ 6.1.*unaffected
  • 6.6.125 to ≤ 6.6.*unaffected
  • 6.12.72 to ≤ 6.12.*unaffected
  • 6.18.11 to ≤ 6.18.*unaffected
  • 6.19.1 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References