CVE-2024-35866

What it actually does

Use-after-free in the Linux kernel SMB client when cifs_dump_full_key() accesses a session structure that is concurrently being torn down with status SES_EXITING.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation; widespread Linux kernel deployments increase exposure across servers and endpoints.

How an attack unfolds

An attacker with local access triggers SMB session teardown while cifs_dump_full_key() is executing, causing the function to dereference a freed session object and corrupt kernel memory.

How to fix it

Apply the upstream fix by updating to a kernel containing commit d798fd98e3563027c5162259ead517057d6fa794 or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify the running kernel source contains commit d798fd98e3563027c5162259ead517057d6fa794; confirm the check for SES_EXITING status exists in cifs_dump_full_key(); test with SMB session teardown workloads.

Typical attack path

1. Obtain local code execution on a Linux host using the vulnerable kernel
2. Initiate or manipulate CIFS/SMB client sessions to force SES_EXITING state
3. Time concurrent calls to cifs_dump_full_key() against the tearing-down session
4. Trigger use-after-free dereference to achieve memory corruption or crash

How to detect it

Review kernel logs for oops or panic messages referencing cifs_dump_full_key or session teardown; inspect for unexpected SMB client crashes coinciding with session exit events.

What your security team should do

• Prioritize kernel updates on all SMB/CIFS client systems within patch windows
• Monitor for local privilege-escalation attempts on Linux endpoints
• Restrict untrusted local user access until patches are deployed