LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23230: smb: client: split cached_fid bitfields to avoid shared-byte RMW races

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-23230 is a high-severity Linux kernel SMB client race condition. When a system uses the SMB client, concurrent updates to shared internal flags can restore stale state. The sources rate potential impact as high for confidentiality, integrity, and availability, but do not show active exploitation.

Executive priority

Treat this as a high-priority patching item for Linux systems that use SMB client functionality, especially servers, workstations, appliances, and industrial environments. There is no sourced active-exploitation signal, so prioritize by SMB usage and asset criticality.

Technical view

The bug is in Linux kernel SMB client cached_fid state handling. Three flags share one bitfield byte, and concurrent read-modify-write updates can reintroduce cleared bits. The resolved change splits those flags into separate bool fields to remove the shared-byte race.

Likely exposure

Exposure is most relevant to Linux systems that use the SMB/CIFS client and run affected kernel versions or downstream products embedding affected kernels. The bundle names Linux as affected and includes a Siemens advisory, but product-level impact should be confirmed with vendor inventories.

Exploitation context

The CVSS vector is network, low complexity, no privileges, and user interaction required. KEV is false, and the supplied sources do not provide evidence of active exploitation, public exploit code, or detailed attack mechanics.

Researcher notes

The core issue is a race caused by packed bitfields updated in separate paths. The source description gives a plausible stale-bit restoration interleaving, but does not provide a complete exploit path, affected distribution matrix, or runtime detection method.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable fixes.
  • Check distribution and appliance vendor advisories for backported fixes.
  • Review Siemens SSA-253495 if Siemens products are in scope.
  • Prioritize systems that mount or access SMB shares.
  • Avoid inventing compensating controls; follow vendor guidance if patching is delayed.

Validation and detection

  • Inventory Linux kernel versions on SMB client systems.
  • Confirm whether deployed kernels include one of the referenced stable commits.
  • Check package changelogs from the operating system vendor.
  • Identify systems using CIFS or SMB mounts.
  • Validate Siemens product exposure against SSA-253495.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23230 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2026-23230Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7, ebe98f1447bbccf8228335c62d86af02a0ed23f7unaffected
LinuxLinux6.1, 0, 6.1.164, 6.6.125, 6.12.72, 6.18.11, 6.19.1, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.