---
id: CVE-2026-98452
title: 'smb: client: clean up failed cached directory opens'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: clean up failed cached directory opens

  open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If
  the CREATE succeeds but a later command ret…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b0f6df737a1c5d9d5ff90cc946205d8af46cc067 <
    48958ddda3d7eee3600261e2d90671f63e055dc4
  - >-
    Linux >= b0f6df737a1c5d9d5ff90cc946205d8af46cc067 <
    abab661eed00fa102d3c35ddf1cce4f687e718c1
  - >-
    Linux >= b0f6df737a1c5d9d5ff90cc946205d8af46cc067 <
    7c1509598a4fdfb54cb09ce33e4405bd6dbd8295
  - >-
    Linux >= b0f6df737a1c5d9d5ff90cc946205d8af46cc067 <
    d2ff5fb93ea83034025850266b5eed391f96b825
  - Linux 5.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:02.436Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98452'
references:
  - url: 'https://git.kernel.org/stable/c/48958ddda3d7eee3600261e2d90671f63e055dc4'
  - url: 'https://git.kernel.org/stable/c/abab661eed00fa102d3c35ddf1cce4f687e718c1'
  - url: 'https://git.kernel.org/stable/c/7c1509598a4fdfb54cb09ce33e4405bd6dbd8295'
  - url: 'https://git.kernel.org/stable/c/d2ff5fb93ea83034025850266b5eed391f96b825'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.303Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clean up failed cached directory opens

open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If
the CREATE succeeds but a later command returns an error, the function
must retain the CREATE FID so common cleanup can issue SMB2_close(). It
also must not treat a response error as a valid CREATE.

Validate the CREATE response before using its fields, record the FIDs, and
mark the handle open before handling errors from later compound commands.
Move the -EREMCHG reconnect handling before response validation so a
missing response does not hide the reconnect request. Count the handle
when it is marked open; confirmed close responses decrement the counter,
while existing close retry behavior remains best effort on transport
failures.

## Affected

- `Linux >= b0f6df737a1c5d9d5ff90cc946205d8af46cc067 < 48958ddda3d7eee3600261e2d90671f63e055dc4`
- `Linux >= b0f6df737a1c5d9d5ff90cc946205d8af46cc067 < abab661eed00fa102d3c35ddf1cce4f687e718c1`
- `Linux >= b0f6df737a1c5d9d5ff90cc946205d8af46cc067 < 7c1509598a4fdfb54cb09ce33e4405bd6dbd8295`
- `Linux >= b0f6df737a1c5d9d5ff90cc946205d8af46cc067 < d2ff5fb93ea83034025850266b5eed391f96b825`
- `Linux 5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.