CVE-2024-35861

What it actually does

Use-after-free in the SMB client when cifs_signal_cifsd_for_reconnect processes sessions whose status is already SES_EXITING, allowing a dangling pointer to be dereferenced during teardown.

Why it matters to the business

Local attackers on Ubuntu 24.04 LTS systems running the affected kernel packages can achieve full system compromise, risking data theft, ransomware deployment, or persistence on servers that mount SMB shares.

How an attack unfolds

An attacker with local code execution triggers or races a CIFS session reconnect while the session is being torn down; the missing SES_EXITING check lets the code access freed memory, leading to arbitrary read/write or control-flow hijacking.

How to fix it

Upgrade linux, linux-aws, and linux-azure packages on Ubuntu 24.04 LTS to the fixed versions 6.8.0-50.51, 6.8.0-1020.22, or 6.8.0-1020.23 respectively and reboot.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the listed fixed packages via uname -r and verify the patch is present in the cifs module source or running kernel symbols.

Typical attack path

1. Obtain local shell or code execution on an affected Ubuntu host
2. Mount or trigger activity on a CIFS/SMB share to initiate reconnect handling
3. Race the session teardown path in cifs_signal_cifsd_for_reconnect
4. Exploit the resulting UAF to corrupt kernel memory and escalate privileges

How to detect it

Review kernel logs and audit records for unexpected crashes or oops in the cifs module around session teardown; look for processes that trigger SMB reconnects followed by privilege-escalation artifacts.

What your security team should do

• Immediately schedule kernel upgrades on all Ubuntu 24.04 LTS systems using the listed fixed package versions
• Prioritize internet-facing or multi-user servers that mount SMB shares
• Monitor for local privilege-escalation attempts until patches are applied