Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-23230 is a high-severity Race Condition (CWE-362) vulnerability in Linux Linux Kernel. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23230 is a race condition vulnerability in the Linux kernel's SMB client implementation. The issue arises from bitfields in the struct cached_fid—specifically is_open, has_lease, and on_list—being stored in the same byte. Concurrent updates from different code paths trigger read-modify-write (RMW) operations, such as on x86_64, which can restore stale flag values. For example, one CPU might load an old byte value while another clears flags, leading the first CPU's RMW store to reintroduce the cleared bits.
The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating exploitation over the network with low complexity, no privileges required, but user interaction needed. A remote attacker could exploit this race in the SMB client to achieve high impacts on confidentiality, integrity, and availability, potentially through corrupted SMB file handle states during concurrent operations.
Mitigation involves applying kernel patches from the referenced stable commits, which resolve the issue by converting the shared bitfields to separate bool fields in struct cached_fid, eliminating the RMW races. Relevant commits include 3eaa22d688311c708b73f3c68bc6d0c8e3f0f77a, 4386f6af8aaedd0c5ad6f659b40cadcc8f423828, 4cfa4c37dcbcfd70866e856200ed8a2894cac578, 569fecc56bfe4df66f05734d67daef887746656b, and c4b9edd55987384a1f201d3d07ff71e448d79c1b. Security practitioners should ensure systems with SMB client usage update to kernels incorporating these fixes.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7671
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code…
more
paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.
Coordination of concurrent security activities reduces the probability that shared resources will be accessed simultaneously without proper synchronization.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions, but does not prevent them at design or coding time.
Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-362, a class-level weakness, and none of its children carries one either.