CVE-2024-35863

What it actually does

Use-after-free in Linux kernel SMB client is_valid_oplock_break() when a session with status SES_EXITING is processed during oplock break handling.

Why it matters to the business

Local attackers on Linux systems using SMB client features could crash the kernel or escalate privileges; the issue has been public for over two years with stable low exploit probability and no known ransomware use.

How an attack unfolds

An attacker with local access triggers SMB session teardown conditions concurrently with oplock break processing so that the function dereferences a freed session structure.

How to fix it

Update the Linux kernel to a version containing commit 494c91e1e9413b407d12166a61b84200d4d54fac or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 494c91e1e9413b407d12166a61b84200d4d54fac via git log or uname output against the fixed tag; test SMB session teardown paths under load.

Typical attack path

1. Obtain local code execution on a Linux host running the vulnerable kernel
2. Establish or manipulate an SMB client session to the point of teardown
3. Force an oplock break event while the session status is transitioning to SES_EXITING
4. Trigger the UAF to read or write attacker-controlled memory for privilege escalation or denial of service

How to detect it

Inspect kernel logs and crash dumps for references to is_valid_oplock_break or SES_EXITING around SMB client activity; correlate with unexpected session teardown events.

• is_valid_oplock_break
• SES_EXITING

What your security team should do

• Apply the kernel update containing commit 494c91e1e9413b407d12166a61b84200d4d54fac on all affected systems
• Prioritize SMB-client hosts and rebuild initramfs images
• Monitor vendor advisories for backported patches in distribution kernels
• Review local access controls to reduce the attack surface for kernel exploits