---
id: CVE-2026-68312
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths

  In cifs_close_deferred_file(), cifs_close_all_deferred_files(), and
  cifs_close_deferred_fi…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths

  In cifs_close_deferred_file(), cifs_close_all_deferred_files(), and
  cifs_close_deferred_fi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e3fc065682ebbbd15b0ce0036800f4acbf765d46 <
    6089f561e2c31a3ba52836c75c7d2ab50d2eea41
  - >-
    Linux >= e3fc065682ebbbd15b0ce0036800f4acbf765d46 <
    32390b3f06f26e366cfb27dbac4bc0196c321535
  - >-
    Linux >= e3fc065682ebbbd15b0ce0036800f4acbf765d46 <
    c2f2e83e3bbc5483730fd4ee903182761f1ae50f
  - Linux 5.15
published: '2026-08-10'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:40.977'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68312'
references:
  - url: 'https://git.kernel.org/stable/c/32390b3f06f26e366cfb27dbac4bc0196c321535'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6089f561e2c31a3ba52836c75c7d2ab50d2eea41'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c2f2e83e3bbc5483730fd4ee903182761f1ae50f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00189
epssPercentile: 0.08011
ingestedAt: '2026-10-15T11:00:41.692Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths

In cifs_close_deferred_file(), cifs_close_all_deferred_files(), and
cifs_close_deferred_file_under_dentry(), when a pending deferred close
is cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to
add the file to the local processing list may fail under memory pressure.
The loop breaks immediately, but the cancelled work is no longer pending
(it would have called _cifsFileInfo_put()), and the cfile is never added
to file_head for processing.  The cifsFileInfo reference and the open
server handle both leak.

Fix by saving the cfile that failed allocation in a local variable,
breaking as before, and calling _cifsFileInfo_put() on it after
releasing the lock.  Any files later in the iteration are unaffected
since their deferred work is still pending and will fire normally.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.