CVE-2026-97557

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid leaking refcount in cifs_queue_oplock_break()

cifs_queue_oplock_break() unconditionally takes a reference on the

target file before queueing cifs_oplock_break(). Only that work item

decreases the reference counter again.

If another oplock break arrives while that work is still queued,

queue_work() will return false and not queue this second work item. As a

result, we will never reach the point to drop the file reference again

and are leaking this reference. This can be triggered when interacting

with a slow-responding server.

As a result, later unmount operations for this file system will fail with

BUG: Dentry ... still in use (1) [unmount of cifs cifs]

VFS: Busy inodes after unmount of cifs (cifs)

kernel BUG at fs/super.c:777!

Fix this by only incrementing the reference count if the work has been

queued successfully. Taking it after queue_work() is safe because all

three callers hold tco

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References