← Back to CVE Explorer

CVE-2026-23230

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.

Severity
MEDIUM
CVSS score
5.5 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-02-18 16:22:32.807000
Last modified
2026-10-19 19:17:42.580000
View original CVE JSON 
{
  "id": "CVE-2026-23230",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-02-18T16:22:32.807",
  "lastModified": "2026-10-19T19:17:42.580",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: split cached_fid bitfields to avoid shared-byte RMW races\n\nis_open, has_lease and on_list are stored in the same bitfield byte in\nstruct cached_fid but are updated in different code paths that may run\nconcurrently. Bitfield assignments generate byte read–modify–write\noperations (e.g. `orb $mask, addr` on x86_64), so updating one flag can\nrestore stale values of the others.\n\nA possible interleaving is:\n    CPU1: load old byte (has_lease=1, on_list=1)\n    CPU2: clear both flags (store 0)\n    CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits\n\nTo avoid this class of races, convert these flags to separate bool\nfields."
    },
    {
      "lang": "es",
      "value": "Se ha resuelto la siguiente vulnerabilidad en el kernel de Linux:\n\nsmb: cliente: dividir los campos de bits de cached_fid para evitar condiciones de carrera RMW de bytes compartidos\n\nis_open, has_lease y on_list se almacenan en el mismo byte de campo de bits en la estructura cached_fid, pero se actualizan en diferentes rutas de código que pueden ejecutarse concurrentemente. Las asignaciones de campos de bits generan operaciones de lectura-modificación-escritura de bytes (p. ej., 'orb $mask, addr' en x86_64), por lo que al actualizar una bandera (flag) se puede restaurar valores obsoletos de las otras.\n\nUna posible intercalación es:\n    CPU1: carga el byte antiguo (has_lease=1, on_list=1)\n    CPU2: borra ambas banderas (almacena 0)\n    CPU1: almacena RMW (old | IS_OPEN) -> reintroduce los bits borrados\n\nPara evitar esta clase de condiciones de carrera, hay que convertir estas banderas a campos bool separados."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/smb/client/cached_dir.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7",
              "lessThan": "569fecc56bfe4df66f05734d67daef887746656b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7",
              "lessThan": "4386f6af8aaedd0c5ad6f659b40cadcc8f423828",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7",
              "lessThan": "3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7",
              "lessThan": "c4b9edd55987384a1f201d3d07ff71e448d79c1b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7",
              "lessThan": "4cfa4c37dcbcfd70866e856200ed8a2894cac578",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ebe98f1447bbccf8228335c62d86af02a0ed23f7",
              "lessThan": "ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/smb/client/cached_dir.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.1",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.1",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.164",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.125",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.72",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.11",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.19.1",
              "lessThanOrEqual": "6.19.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.0",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "RUGGEDCOM RST2428P",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThan": "V4.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T15:06:47.736511Z",
          "id": "CVE-2026-23230",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.1",
              "versionEndExcluding": "6.1.164",
              "matchCriteriaId": "8174AEBD-5EC1-4209-8FCF-6A75AA321999"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2",
              "versionEndExcluding": "6.6.125",
              "matchCriteriaId": "74B70CDE-7B74-4280-BBCC-8889B8F28466"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.72",
              "matchCriteriaId": "F1A7E514-FB3C-4B6B-8046-07D5A8F04644"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.18.11",
              "matchCriteriaId": "7099A9EC-3D54-4424-BF01-7224EF88C79C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "6.19.1",
              "matchCriteriaId": "EE543C0D-A06B-414F-A403-CB1E088F261E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/4cfa4c37dcbcfd70866e856200ed8a2894cac578",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/569fecc56bfe4df66f05734d67daef887746656b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/c4b9edd55987384a1f201d3d07ff71e448d79c1b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html",
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ]
}