---
id: CVE-2026-97557
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: avoid leaking refcount in cifs_queue_oplock_break()

  cifs_queue_oplock_break() unconditionally takes a reference on the
  target file before queueing cifs_op…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: avoid leaking refcount in cifs_queue_oplock_break()

  cifs_queue_oplock_break() unconditionally takes a reference on the
  target file before queueing cifs_op…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-911
  - CWE-401
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    735a3a610136ae10f381d0909dff38e5b5c5f056
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    de2a6bcff2659bea40c7485115b57f0ae189fc01
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    af0193bbf1ac8c0f67f972998b0cc629d6116cf6
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    2ed2c29dd9593637cfa25ac1eb23241b20202778
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    dfe7b750c7e069873a8a57a11c816831a235618a
  - >-
    Linux >= b98749cac4a695f084a5ff076f4510b23e353ecd <
    9f2e63f1b2d5fc5b5423424902c091123e220e7e
  - Linux 2429fcf06d3cb962693868ab0a927c9038f12a2d
  - Linux 1ee4f2d7cdcd4508cc3cbe3b2622d7177b89da12
  - Linux 53fc31a4853e30d6e8f142b824f724da27ff3e40
  - Linux 8092ecc306d81186a64cda42411121f4d35aaff4
  - Linux ebac4d0adf68f8962bd82fcf483936edd6ec095b
  - Linux >= 3.16.72 < 3.17
  - Linux >= 4.9.171 < 4.10
  - Linux >= 4.14.114 < 4.15
  - Linux >= 4.19.37 < 4.20
  - Linux >= 5.0.10 < 5.1
  - Linux 5.1
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:03.447'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97557'
references:
  - url: 'https://git.kernel.org/stable/c/2ed2c29dd9593637cfa25ac1eb23241b20202778'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/735a3a610136ae10f381d0909dff38e5b5c5f056'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9f2e63f1b2d5fc5b5423424902c091123e220e7e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/af0193bbf1ac8c0f67f972998b0cc629d6116cf6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/de2a6bcff2659bea40c7485115b57f0ae189fc01'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dfe7b750c7e069873a8a57a11c816831a235618a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97557.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97557'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541214'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97557'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97557'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97557.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-97557'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00665
epssPercentile: 0.51555
scores:
  nvd: 7.5
  vendor: 5.1
  cna: 7.5
ingestedAt: '2026-09-25T11:06:38.917Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid leaking refcount in cifs_queue_oplock_break()

cifs_queue_oplock_break() unconditionally takes a reference on the
target file before queueing cifs_oplock_break(). Only that work item
decreases the reference counter again.

If another oplock break arrives while that work is still queued,
queue_work() will return false and not queue this second work item. As a
result, we will never reach the point to drop the file reference again
and are leaking this reference. This can be triggered when interacting
with a slow-responding server.

As a result, later unmount operations for this file system will fail with

  BUG: Dentry ... still in use (1) [unmount of cifs cifs]
  VFS: Busy inodes after unmount of cifs (cifs)
  kernel BUG at fs/super.c:777!

Fix this by only incrementing the reference count if the work has been
queued successfully. Taking it after queue_work() is safe because all
three callers hold tcon->open_file_lock across the call and
_cifsFileInfo_put() decrements under that same lock, so a worker that
starts the handler in the window cannot drop the reference before it has
been taken.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97557.json)