{"id":"CVE-2026-98175","published":"2026-10-06T09:17:59.477","lastModified":"2026-10-07T07:17:04.003","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: cancel reconnect work in clean_demultiplex_info()\n\nclean_demultiplex_info() cancels server->echo delayed work but not\nserver->reconnect, which can cause a use-after-free when the\ndemultiplex thread exits while a reconnect work is still queued:\n\n  cifs_demultiplex_thread()\n    cifs_readv_from_socket()\n      cifs_reconnect()\n        __cifs_reconnect()\n          cifs_queue_server_reconn()\n            mod_delayed_work(cifsiod_wq, &server->reconnect, 0)\n    clean_demultiplex_info()\n      cancel_delayed_work_sync(&server->echo)   // echo canceled\n                                                 // reconnect NOT canceled\n      kfree_sensitive(server)                    // server freed\n\n  ...later, on cifsiod_wq:\n\n  smb2_reconnect_server()\n    server->srv_count  // UAF read of freed server\n\nFix this by canceling server->reconnect delayed work in\nclean_demultiplex_info() before the server is freed, the same way\ncifs_put_tcp_session() already does.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149","tags":[]},{"url":"https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8","tags":[]},{"url":"https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a","tags":[]},{"url":"https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1","tags":[]},{"url":"https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's SMB client has a use-after-free vulnerability where the reconnect work item is not properly canceled during cleanup, potentially leading to memory corruption when the demultiplex thread exits while reconnect work is still queued. This flaw can be triggered by network disconnections and reconnections in SMB sessions.","exploitability":"Exploitation is moderately difficult as it requires precise timing of network disconnections and reconnections to queue the reconnect work before cleanup, with no additional preconditions beyond normal SMB client usage.","blast_radius":"The vulnerability could affect any Linux system using SMB client functionality, particularly those with active SMB shares or network connections, potentially leading to system instability or privilege escalation through memory corruption.","remediation":"Upgrade to Linux kernel version 6.12 or later where this fix is included.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["smb","memory-corruption","kernel"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:06:25.066Z"}}