---
id: CVE-2026-98449
title: 'smb: client: delete compound mids on send failure before unlock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: delete compound mids on send failure before unlock

  When sending a compound request fails, smb_send_rqst() kicks off a
  reconnect. compound_send_recv() stil…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ee258d79159afed52ca9372aeb9c1a51e89b32ee <
    70783946f3b5d0c06ec7df0f5e7bec2bfad24efb
  - >-
    Linux >= ee258d79159afed52ca9372aeb9c1a51e89b32ee <
    8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9
  - Linux 3c57a0be487088b08d9c88998f911eb4a7ba36e4
  - Linux >= 4.20.11 < 4.21
  - Linux 5.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:14:59.772Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98449'
references:
  - url: 'https://git.kernel.org/stable/c/70783946f3b5d0c06ec7df0f5e7bec2bfad24efb'
  - url: 'https://git.kernel.org/stable/c/8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.304Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: delete compound mids on send failure before unlock

When sending a compound request fails, smb_send_rqst() kicks off a
reconnect. compound_send_recv() still has those mids on pending_mid_q,
but it unlocks the server without removing them first.

During reconnect, cifs_abort_connection() walks pending_mid_q and runs
each mid callback. With no response yet, those callbacks return credits
and drop in_flight. Then compound_send_recv()'s send-error path returns
the same credits again. in_flight ends up decremented twice and
smb2_add_credits() WARNs.

syzbot hits this during SMB2_negotiate when the socket send fails.

cifs_call_async() already calls delete_mid() before unlock on send
failure. Do the same for compound chains and set cancelled_mid[] so the
out: path does not delete them again.

## Affected

- `Linux >= ee258d79159afed52ca9372aeb9c1a51e89b32ee < 70783946f3b5d0c06ec7df0f5e7bec2bfad24efb`
- `Linux >= ee258d79159afed52ca9372aeb9c1a51e89b32ee < 8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9`
- `Linux 3c57a0be487088b08d9c88998f911eb4a7ba36e4`
- `Linux >= 4.20.11 < 4.21`
- `Linux 5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.