Home

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.

PUBLISHED Reserved 2026-01-13 | Published 2026-02-18 | Updated 2026-02-23 | Assigner Linux

Product status

Default status
unaffected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before 569fecc56bfe4df66f05734d67daef887746656b
affected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before 4386f6af8aaedd0c5ad6f659b40cadcc8f423828
affected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before 3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a
affected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before c4b9edd55987384a1f201d3d07ff71e448d79c1b
affected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before 4cfa4c37dcbcfd70866e856200ed8a2894cac578
affected

ebe98f1447bbccf8228335c62d86af02a0ed23f7 (git) before ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241
affected

Default status
affected

6.1
affected

Any version before 6.1
unaffected

6.1.164 (semver)
unaffected

6.6.125 (semver)
unaffected

6.12.72 (semver)
unaffected

6.18.11 (semver)
unaffected

6.19.1 (semver)
unaffected

7.0-rc1 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/569fecc56bfe4df66f05734d67daef887746656b

git.kernel.org/...c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828

git.kernel.org/...c/3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a

git.kernel.org/...c/c4b9edd55987384a1f201d3d07ff71e448d79c1b

git.kernel.org/...c/4cfa4c37dcbcfd70866e856200ed8a2894cac578

git.kernel.org/...c/ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241

cve.org (CVE-2026-23230)

nvd.nist.gov (CVE-2026-23230)

Download JSON