{"id":"CVE-2026-98173","published":"2026-10-06T09:17:59.060","lastModified":"2026-10-07T07:17:03.737","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of iface in cifs_try_adding_channels()\n\ncifs_try_adding_channels() iterates ses->iface_list with\nlist_for_each_entry_safe_from(), which captures the next entry\n(niface) under iface_lock.  The loop body then drops iface_lock for\nthe whole duration of cifs_ses_add_channel().\n\nA concurrent interface refresh (SMB3_request_interfaces() ->\nparse_server_interfaces()) marks all ifaces inactive and removes and\nfrees any that are not re-advertised via list_del() + kref_put(),\nwhere release_iface() is a bare kfree().  Since niface typically has\nno channel holding a reference, the list reference is its last and it\ncan be freed inside the unlocked window.  On continue, the iterator\nadvance step then dereferences niface->iface_head.next, and the loop\nbody reads iface->rdma_capable/is_active, both on freed memory.\n\nFix this by never keeping an unreferenced list pointer across the\nunlocked window.  Each channel attempt now re-scans the list from the\nhead under iface_lock, takes a kref on the selected candidate, and\npasses only that referenced candidate to cifs_ses_add_channel().\nweight_fulfilled still tracks selection progress, so restarting the\nscan preserves the original weighted distribution and the\nweight_fulfilled-before-kref_put ordering on the failure path.\n\nAdd a per-pass attempts cap so a flapping interface refresh cannot\nkeep the inner loop spinning within a single tries increment.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/c941f1ebfd26f683de81091473f3596a218abff0","tags":[]},{"url":"https://git.kernel.org/stable/c/d034e836eefd7ce75e588f7031cffbeec594f5ac","tags":[]},{"url":"https://git.kernel.org/stable/c/e99040e5e9c60441e6b4725e1a7b88c3106ae903","tags":[]},{"url":"https://git.kernel.org/stable/c/ec36b38e65596950e6c29bed7dfc90b98707c19c","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's SMB client contains a use-after-free vulnerability in cifs_try_adding_channels() where a freed network interface structure is accessed after a concurrent interface refresh operation. This occurs when the function iterates through interface lists without maintaining proper reference counts across an unlocked window, potentially leading to memory corruption and system instability.","exploitability":"Exploitation is moderately difficult requiring a specific sequence of concurrent operations involving SMB interface refresh and channel addition, with no public exploit available but likely possible with careful timing and network conditions.","blast_radius":"The vulnerability affects systems running Linux kernels with SMB client functionality, potentially causing system crashes or memory corruption when multiple SMB sessions attempt to establish channels concurrently with interface refresh operations.","remediation":"Upgrade to Linux kernel version 6.12 or later where this use-after-free issue has been fixed in the cifs module.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["smb","memory-corruption","kernel","network"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:06:36.421Z"}}