LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23230: smb: client: split cached_fid bitfields to avoid shared-byte RMW races

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race condition in the Linux SMB client can accidentally restore file-handle status flags that another CPU already cleared. This may leave the kernel acting on stale SMB state. The supplied assessment rates potential confidentiality, integrity, and availability impact as high, but the sources do not describe a demonstrated attack outcome.

Executive priority

Prioritize remediation for servers, workstations, and appliances that actively access SMB shares, especially across untrusted networks. Treat this as a high-priority kernel update, but not an emergency driven by known exploitation. Systems without SMB client use have lower practical exposure.

Technical view

Three cached_fid flags shared one bitfield byte and were modified concurrently through byte-level read-modify-write operations. One CPU could write an older byte value after another cleared flags, reintroducing stale state. Linux corrected the race by replacing the shared bitfields with separate boolean fields.

Likely exposure

Exposure is limited to systems using the Linux SMB client on affected kernels, particularly those communicating with untrusted or attacker-influenced SMB servers. The supplied affected-version data is ambiguous, so package version alone may be insufficient; distribution backports and the listed stable-kernel commits must be checked.

Exploitation context

The CVSS 3.1 score is 8.8 with network reachability, low complexity, no privileges, and required user interaction. The supplied bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public proof-of-concept exploitation, or weaponization.

Researcher notes

The core defect is a concurrency race rather than a conventional bounds or memory-corruption flaw: independent logical flags shared one storage byte. The sources establish stale-bit restoration and the structural fix, but do not document a reproducible security impact path. Version-range interpretation requires vendor confirmation because the supplied affected data is unclear.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable listed stable-kernel fix, then reboot into it.
  • Check Linux distribution and appliance advisories for package-specific backport status.
  • Disable unnecessary SMB client use and restrict outbound SMB access where operationally feasible.
  • Review the Siemens advisory if affected Siemens products exist in the environment.

Validation and detection

  • Inventory running kernels and identify systems that mount or access SMB shares.
  • Map each kernel package to vendor advisories or the applicable stable-kernel fix commit.
  • Confirm updated systems are running the remediated kernel after reboot.
  • Reassess outbound SMB controls and remove access not required for business operations.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23230 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2026-23230Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7unaffected
LinuxLinux6.1, 0, 6.1.164, 6.6.125, 6.12.72, 6.18.11, 6.19.1, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.