CVE-2024-35862

What it actually does

Use-after-free in smb2_is_network_name_deleted() when an SMB session with status SES_EXITING is accessed during teardown.

Why it matters to the business

Local attackers on Linux systems using the SMB client can trigger kernel memory corruption, leading to crashes, data loss, or privilege escalation that disrupts operations or compromises hosts.

How an attack unfolds

An attacker with local access races SMB session teardown (setting SES_EXITING) against concurrent calls to smb2_is_network_name_deleted(), causing the function to dereference a freed session object and corrupt kernel memory.

How to fix it

Update the Linux kernel to include commit f9414004798d9742c1af23a1d839fe6a9503751c or apply a vendor backport that skips sessions with status SES_EXITING in smb2_is_network_name_deleted().

How to confirm the fix worked

Confirm the patch is present by inspecting the smb2_is_network_name_deleted() function for the SES_EXITING status check, or verify the commit hash in the running kernel source tree.

Typical attack path

1. Obtain local access on an affected Linux host
2. Trigger SMB session teardown via network or mount operations
3. Time access to smb2_is_network_name_deleted() to hit the exiting session
4. Exploit resulting UAF for code execution or denial of service

How to detect it

Review kernel logs for oops, panic, or slab-use-after-free messages referencing SMB or cifs session teardown; correlate with SMB mount activity around the time of the crash.

What your security team should do

• Apply the referenced kernel commit or newer stable release immediately on all SMB-client systems
• Restrict local user access on multi-user Linux hosts until patched
• Test SMB workloads after upgrade to ensure session handling stability