CVE-2024-26928

What it actually does

Use-after-free condition in the Linux kernel CIFS/SMB client debug proc handler (cifs_debug_files_proc_show) when a session with SES_EXITING status is referenced during teardown.

Why it matters to the business

Local attackers on affected Ubuntu AWS instances can trigger kernel crashes or attempt code execution via SMB client debug interfaces, risking system stability and data exposure on servers handling file shares.

How an attack unfolds

An attacker with local user access on a system using the vulnerable linux-aws-5.15 kernel opens the CIFS debug proc file while an SMB session is concurrently being torn down, causing the handler to dereference freed session structures.

How to fix it

Upgrade the linux-aws-5.15 package on Ubuntu 20.04 LTS to version 5.15.0-1072.78~20.04.1 or later and reboot to apply the fix that skips exiting sessions.

How to confirm the fix worked

Verify installed kernel package version matches or exceeds 5.15.0-1072.78~20.04.1 using dpkg or apt, then confirm absence of the vulnerable cifs_debug_files_proc_show logic via source inspection or kernel symbol checks.

Typical attack path

1. Obtain local shell access on target Ubuntu 20.04 AWS instance
2. Mount or trigger SMB/CIFS sessions that enter SES_EXITING state
3. Concurrently read from /proc/fs/cifs or related debug files to invoke cifs_debug_files_proc_show
4. Trigger use-after-free by racing teardown with proc access
5. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for oops or panic entries referencing cifs_debug_files_proc_show or SES_EXITING around the time of SMB session teardown; examine audit logs for unusual local reads of CIFS proc files.

What your security team should do

• Prioritize patching all linux-aws-5.15 instances to the fixed 5.15.0-1072.78~20.04.1 release within standard maintenance windows
• Audit systems for active SMB/CIFS mounts and restrict local access to /proc/fs/cifs debug paths where possible
• Monitor EPSS and KEV status for any future increases in exploit activity