CVE-2026-98175

Summary

The Linux kernel's SMB client has a use-after-free vulnerability where the reconnect work item is not properly canceled during cleanup, potentially leading to memory corruption when the demultiplex thread exits while reconnect work is still queued. This flaw can be triggered by network disconnections and reconnections in SMB sessions.

Exploitability

Exploitation is moderately difficult as it requires precise timing of network disconnections and reconnections to queue the reconnect work before cleanup, with no additional preconditions beyond normal SMB client usage.

Blast radius

The vulnerability could affect any Linux system using SMB client functionality, particularly those with active SMB shares or network connections, potentially leading to system instability or privilege escalation through memory corruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Linux kernel version 6.12 or later where this fix is included.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.