CVE-2026-98173

7.5 HIGH

Published 2026-10-06 · Updated 2026-10-07

AI risk analysis

Summary: The Linux kernel's SMB client contains a use-after-free vulnerability in cifs_try_adding_channels() where a freed network interface structure is accessed after a concurrent interface refresh operation. This occurs when the function iterates through interface lists without maintaining proper reference counts across an unlocked window, potentially leading to memory corruption and system instability.
Exploitability: Exploitation is moderately difficult requiring a specific sequence of concurrent operations involving SMB interface refresh and channel addition, with no public exploit available but likely possible with careful timing and network conditions.
Blast radius: The vulnerability affects systems running Linux kernels with SMB client functionality, potentially causing system crashes or memory corruption when multiple SMB sessions attempt to establish channels concurrently with interface refresh operations.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Linux kernel version 6.12 or later where this use-after-free issue has been fixed in the cifs module.

smbmemory-corruptionkernelnetwork

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels() cifs_try_adding_channels() iterates ses->iface_list with list_for_each_entry_safe_from(), which captures the next entry (niface) under iface_lock. The loop body then drops iface_lock for the whole duration of cifs_ses_add_channel(). A concurrent interface refresh (SMB3_request_interfaces() -> parse_server_interfaces()) marks all ifaces inactive and removes and frees any that are not re-advertised via list_del() + kref_put(), where release_iface() is a bare kfree(). Since niface typically has no channel holding a reference, the list reference is its last and it can be freed inside the unlocked window. On continue, the iterator advance step then dereferences niface->iface_head.next, and the loop body reads iface->rdma_capable/is_active, both on freed memory. Fix this by never keeping an unreferenced list pointer across the unlocked window. Each channel attempt now re-scans the list from the head under iface_lock, takes a kref on the selected candidate, and passes only that referenced candidate to cifs_ses_add_channel(). weight_fulfilled still tracks selection progress, so restarting the scan preserves the original weighted distribution and the weight_fulfilled-before-kref_put ordering on the failure path. Add a per-pass attempts cap so a flapping interface refresh cannot keep the inner loop spinning within a single tries increment.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.