CVE-2026-23230

Vulnerability

A race condition exists in the Linux kernel's SMB client within the cached_fid structure. Three flags (is_open, has_lease, on_list) are stored as bitfields in the same byte. Bitfield assignments are not atomic—they perform a read-modify-write operation on the entire byte. When concurrent code paths update different flags, one path can overwrite another's changes, restoring stale values [1].

Exploitation

To exploit this, an attacker must trigger concurrent SMB operations that modify distinct flags. For example, one path sets is_open while another clears has_lease and on_list. A possible interleaving described in the advisory shows that the clearing operation can be undone, leading to inconsistent state [1].

Impact

This race can result in use-after-free or other memory corruption when the cached_fid is incorrectly considered open or leased. An attacker with the ability to execute code at the SMB client layer could potentially escalate privileges or cause a denial of service [1].

Mitigation

The fix separates the flags into individual bool fields, eliminating the shared byte and thus the read-modify-write race [4]. Users should update to a patched Linux kernel version that includes this commit.