CVE-2026-23230

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: split cached_fid bitfields to avoid shared-byte RMW races<br /> <br /> is_open, has_lease and on_list are stored in the same bitfield byte in<br /> struct cached_fid but are updated in different code paths that may run<br /> concurrently. Bitfield assignments generate byte read–modify–write<br /> operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can<br /> restore stale values of the others.<br /> <br /> A possible interleaving is:<br /> CPU1: load old byte (has_lease=1, on_list=1)<br /> CPU2: clear both flags (store 0)<br /> CPU1: RMW store (old | IS_OPEN) -&gt; reintroduces cleared bits<br /> <br /> To avoid this class of races, convert these flags to separate bool<br /> fields.