CVE-2026-97558

A denial-of-service flaw rated moderate by Red Hat was found in the Linux kernel's SMB client subsystem in its deferred close handling. When cifs_close() defers a close while the deferred workqueue callback is running, a race condition can leave the work pending with its scheduling flag cleared; a later open and close that reuses the handle then fails to queue the deferred work and returns without dropping the closing file's cifsFileInfo reference. A local user able to perform open and close operations on files on a mounted SMB share can repeatedly trigger this race, keeping kernel file structures, tlink, dentry, and server handles pinned in memory. Over time this resource leak can exhaust kernel memory and disrupt system availability; there is no impact on confidentiality or integrity.

Red Hat Enterprise Linux 6 ELS, Red Hat Enterprise Linux 7 ELS, and Red Hat Enterprise Linux 8 (including its kernel and kernel-rt streams) are not affected because the vulnerable code is not present in those kernels. Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipped with RHEL CoreOS 9 are affected. For these affected products the fix is deferred to a future scheduled update because this is a narrow timing-window resource leak rather than memory corruption, and its practical impact is limited to gradual resource exhaustion on systems performing intensive SMB client file operations. The residual risk until the fix is delivered is denial of service through accumulated kernel memory consumption on such systems.