---
id: CVE-2026-23230
title: 'smb: client: split cached_fid bitfields to avoid shared-byte RMW races'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: split cached_fid bitfields to avoid shared-byte RMW races

  is_open, has_lease and on_list are stored in the same bitfield byte in
  struct cached_fid but are…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    569fecc56bfe4df66f05734d67daef887746656b
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    4386f6af8aaedd0c5ad6f659b40cadcc8f423828
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    c4b9edd55987384a1f201d3d07ff71e448d79c1b
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    4cfa4c37dcbcfd70866e856200ed8a2894cac578
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241
  - Linux 6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:06:47.736511Z'
published: '2026-02-18'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:50.544Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23230'
references:
  - url: 'https://git.kernel.org/stable/c/569fecc56bfe4df66f05734d67daef887746656b'
  - url: 'https://git.kernel.org/stable/c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828'
  - url: 'https://git.kernel.org/stable/c/3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a'
  - url: 'https://git.kernel.org/stable/c/c4b9edd55987384a1f201d3d07ff71e448d79c1b'
  - url: 'https://git.kernel.org/stable/c/4cfa4c37dcbcfd70866e856200ed8a2894cac578'
  - url: 'https://git.kernel.org/stable/c/ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241'
tags:
  - cve.org
epss: 0.00262
epssPercentile: 0.16821
ingestedAt: '2026-10-16T17:24:46.641Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: split cached_fid bitfields to avoid shared-byte RMW races

is_open, has_lease and on_list are stored in the same bitfield byte in
struct cached_fid but are updated in different code paths that may run
concurrently. Bitfield assignments generate byte read–modify–write
operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can
restore stale values of the others.

A possible interleaving is:
    CPU1: load old byte (has_lease=1, on_list=1)
    CPU2: clear both flags (store 0)
    CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits

To avoid this class of races, convert these flags to separate bool
fields.

## Affected

- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < 569fecc56bfe4df66f05734d67daef887746656b`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < 4386f6af8aaedd0c5ad6f659b40cadcc8f423828`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < 3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < c4b9edd55987384a1f201d3d07ff71e448d79c1b`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < 4cfa4c37dcbcfd70866e856200ed8a2894cac578`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241`
- `Linux 6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.