CVE-2024-35864

What it actually does

Use-after-free in the Linux kernel SMB client when smb2_is_valid_lease_break processes lease breaks for sessions with status SES_EXITING during teardown.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption leading to crashes, privilege escalation, or arbitrary code execution in the SMB client path.

How an attack unfolds

An attacker with local access initiates or manipulates SMB sessions and lease operations so that a lease break callback occurs after a session has begun teardown but before full cleanup, dereferencing freed memory.

How to fix it

Update the Linux kernel to a version containing commit c868cabdf6fdd61bea54532271f4708254e57fc5 or later stable releases that include the fix for skipping SES_EXITING sessions in smb2_is_valid_lease_break.

How to confirm the fix worked

Verify the running kernel source contains commit c868cabdf6fdd61bea54532271f4708254e57fc5 or confirm the patched smb2_is_valid_lease_break logic skips sessions with status SES_EXITING; test lease break handling under session teardown conditions.

Typical attack path

1. Obtain local user access on a Linux host using the SMB client
2. Trigger SMB session establishment and lease acquisition
3. Force or race session teardown (SES_EXITING state)
4. Induce lease break handling in smb2_is_valid_lease_break on the freed session object
5. Achieve UAF read/write for privilege escalation or denial of service

How to detect it

Review kernel logs for oops, panic, or use-after-free warnings involving smb2_is_valid_lease_break or cifs/smb2 session teardown; correlate with SMB session activity preceding crashes.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all systems using the SMB client
• Restrict local unprivileged access where possible until patched
• Monitor for kernel oops or crashes related to SMB lease handling as a temporary indicator