CVE-2026-98261
8.1 HIGHPublished 2026-10-06 · Updated 2026-10-07
AI risk analysis
- Summary
- The Linux kernel's CIFS implementation contains a use-after-free vulnerability in the cifs_chan_skip_or_disable() function where it continues to reference freed memory after dropping channel references. This occurs when a secondary channel is disabled and can lead to arbitrary code execution or system instability.
- Exploitability
- Exploitation requires precise timing and memory layout control to trigger the use-after-free condition during channel teardown, with no specific preconditions mentioned.
- Blast radius
- If exploited, this vulnerability could affect any Linux system using CIFS shares with secondary channels, potentially leading to remote code execution or denial of service across networked file systems.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Apply kernel patch for Linux kernel version 5.19.10 or later which includes the fix for cifs_chan_skip_or_disable() use-after-free vulnerability.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifs_chan_skip_or_disable() When a secondary channel is no longer supported by the server, cifs_chan_skip_or_disable() drops the channel reference with cifs_put_tcp_session() and then continues to use the server pointer by calling cifs_signal_cifsd_for_reconnect() on it and reading its primary_server pointer. cifs_put_tcp_session() can drop the last reference of the channel and tear it down, so both the channel and the primary server (whose reference is also dropped by cifs_put_tcp_session()) can be freed before they are signaled for reconnect. Signal the channel and the primary server and capture the primary server pointer before dropping the channel reference with cifs_put_tcp_session().
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
All references
- https://git.kernel.org/stable/c/0338489960ddad6368bce55e8adbc176c523093d
- https://git.kernel.org/stable/c/717e0a25036b6c92cecace30913b2d874a4c22b8
- https://git.kernel.org/stable/c/7a1b27780b113583a94256d58dabfe7c0d9286e7
- https://git.kernel.org/stable/c/edd52eae5fcfb8433b6bb0e7cd98db438fe01227
- https://git.kernel.org/stable/c/fcc0a935bb6e37ecbf7e4335061309f896f35780
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-64561PoC
- CRITICALCVE-2026-64566
- HIGHCVE-2026-64574
- HIGHCVE-2026-71226
- HIGHCVE-2026-89789
- HIGHCVE-2026-89805
- HIGHCVE-2026-89815
- HIGHCVE-2026-89856
Related by shared AI tags and CWE weakness class. Browse the full archive.