https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 06:18:08 +0000 https://db.gcve.eu/vuln/cve-2026-98449 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: delete compound mids on send failure before unlock</p> <p>When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server without removing them first.</p> <p>During reconnect, cifs_abort_connection() walks pending_mid_q and runs each mid callback. With no response yet, those callbacks return credits and drop in_flight. Then compound_send_recv()&#39;s send-error path returns the same credits again. in_flight ends up decremented twice and smb2_add_credits() WARNs.</p> <p>syzbot hits this during SMB2_negotiate when the socket send fails.</p> <p>cifs_call_async() already calls delete_mid() before unlock on send failure. Do the same for compound chains and set cancelled_mid[] so the out: path does not delete them again.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: delete compound mids on send failure before unlock</p> <p>When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server without removing them first.</p> <p>During reconnect, cifs_abort_connection() walks pending_mid_q and runs each mid callback. With no response yet, those callbacks return credits and drop in_flight. Then compound_send_recv()&#39;s send-error path returns the same credits again. in_flight ends up decremented twice and smb2_add_credits() WARNs.</p> <p>syzbot hits this during SMB2_negotiate when the socket send fails.</p> <p>cifs_call_async() already calls delete_mid() before unlock on send failure. Do the same for compound chains and set cancelled_mid[] so the out: path does not delete them again.</p> https://db.gcve.eu/vuln/cve-2026-98449