---
id: CVE-2026-97557
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: avoid leaking refcount in cifs_queue_oplock_break()

  cifs_queue_oplock_break() unconditionally takes a reference on the
  target file before queueing cifs_op…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: avoid leaking refcount in cifs_queue_oplock_break()

  cifs_queue_oplock_break() unconditionally takes a reference on the
  target file before queueing cifs_op…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    af0193bbf1ac8c0f67f972998b0cc629d6116cf6
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    2ed2c29dd9593637cfa25ac1eb23241b20202778
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    dfe7b750c7e069873a8a57a11c816831a235618a
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    9f2e63f1b2d5fc5b5423424902c091123e220e7e
  - Linux 2429fcf06d3cb962693868ab0a927c9038f12a2d
  - Linux 1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12
  - Linux 53fc31a4853e30d6e8f142b824f724da27ff3e40
  - Linux 8092ecc306d81186a64cda42411121f4d35aaff4
  - Linux ebac4d0adf68f8962bd82fcf483936edd6ec095b
  - Linux >= 3.16.72 < 3.17
  - Linux >= 4.9.171 < 4.10
  - Linux >= 4.14.114 < 4.15
  - Linux >= 4.19.37 < 4.20
  - Linux >= 5.0.10 < 5.1
  - Linux 5.1
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:17:58.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97557'
references:
  - url: 'https://git.kernel.org/stable/c/2ed2c29dd9593637cfa25ac1eb23241b20202778'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9f2e63f1b2d5fc5b5423424902c091123e220e7e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/af0193bbf1ac8c0f67f972998b0cc629d6116cf6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dfe7b750c7e069873a8a57a11c816831a235618a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.917Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid leaking refcount in cifs_queue_oplock_break()

cifs_queue_oplock_break() unconditionally takes a reference on the
target file before queueing cifs_oplock_break(). Only that work item
decreases the reference counter again.

If another oplock break arrives while that work is still queued,
queue_work() will return false and not queue this second work item. As a
result, we will never reach the point to drop the file reference again
and are leaking this reference. This can be triggered when interacting
with a slow-responding server.

As a result, later unmount operations for this file system will fail with

  BUG: Dentry ... still in use (1) [unmount of cifs cifs]
  VFS: Busy inodes after unmount of cifs (cifs)
  kernel BUG at fs/super.c:777!

Fix this by only incrementing the reference count if the work has been
queued successfully. Taking it after queue_work() is safe because all
three callers hold tcon->open_file_lock across the call and
_cifsFileInfo_put() decrements under that same lock, so a worker that
starts the handler in the window cannot drop the reference before it has
been taken.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.