CVE-2024-35865

What it actually does

Use-after-free in the SMB client when smb2_is_valid_oplock_break processes an oplock break for a session whose status is already SES_EXITING during teardown.

Why it matters to the business

Local users or processes on Linux systems using the SMB client can trigger kernel instability or crashes, leading to denial of service and potential loss of availability on file-sharing workloads.

How an attack unfolds

An attacker with local access triggers concurrent SMB client operations that race with session teardown; the code dereferences a freed session structure instead of skipping sessions marked SES_EXITING, resulting in a use-after-free that crashes the kernel.

How to fix it

Update the Linux kernel to a version containing commit 84488466b7a69570bdbf76dd9576847ab97d54e7 or later; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 84488466b7a69570bdbf76dd9576847ab97d54e7 or is from a distribution release that backported the fix; confirm the smb2_is_valid_oplock_break function now checks for SES_EXITING before use.

Typical attack path

1. Obtain local access on a Linux host running the vulnerable kernel with SMB client enabled
2. Initiate SMB connections and trigger oplock break handling
3. Force or race session teardown (status == SES_EXITING)
4. Trigger the UAF in smb2_is_valid_oplock_break to cause kernel panic or crash

How to detect it

Review kernel logs for oops or panic entries referencing smb2_is_valid_oplock_break or session teardown races; correlate with SMB client activity preceding the crash.

What your security team should do

• Prioritize kernel updates containing commit 84488466b7a69570bdbf76dd9576847ab97d54e7 on all systems using the SMB client
• Apply updates within standard patch windows given the low EPSS and lack of KEV listing
• Monitor for kernel oops/panic events correlated with SMB activity until patches are deployed