CVE-2026-68312

Source
https://cve.org/CVERecord?id=CVE-2026-68312
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68312.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-68312
Downstream
AZL (1)
BELL (1)
DEBIAN (1)
SUSE (6)
UBUNTU (1)
Related
Published
2026-08-10T12:02:46Z
Modified
2026-09-18T10:11:50Z
Summary
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
Details

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths

In cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry(), when a pending deferred close is cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to add the file to the local processing list may fail under memory pressure. The loop breaks immediately, but the cancelled work is no longer pending (it would have called _cifsFileInfo_put()), and the cfile is never added to file_head for processing. The cifsFileInfo reference and the open server handle both leak.

Fix by saving the cfile that failed allocation in a local variable, breaking as before, and calling _cifsFileInfo_put() on it after releasing the lock. Any files later in the iteration are unaffected since their deferred work is still pending and will fire normally.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68312.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e3fc065682ebbbd15b0ce0036800f4acbf765d46
Fixed
32390b3f06f26e366cfb27dbac4bc0196c321535
Fixed
c2f2e83e3bbc5483730fd4ee903182761f1ae50f

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68312.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
7.1.6

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68312.json"