CVE-2024-35867

What it actually does

Use-after-free in the SMB client procfs handler cifs_stats_proc_show() when a session with status SES_EXITING is concurrently torn down while its statistics are being read.

Why it matters to the business

Linux systems acting as SMB clients may experience kernel crashes, memory corruption, or potential local privilege escalation during normal filesystem activity or monitoring, increasing downtime and security risk on servers and workstations that mount remote shares.

How an attack unfolds

An attacker with local access or the ability to influence SMB session lifecycle triggers session teardown (status set to SES_EXITING) while a concurrent read of /proc/fs/cifs/Stats triggers the vulnerable proc show function, dereferencing freed session structures.

How to fix it

Update the Linux kernel to a version containing commit 838ec01ea8d3deb5d123e8ed9022e8162dc3f503 or later; rebuild and reboot affected systems; verify the fix is present via kernel source or package version checks.

How to confirm the fix worked

Confirm the running kernel includes commit 838ec01ea8d3deb5d123e8ed9022e8162dc3f503; test that sessions entering SES_EXITING are skipped in cifs_stats_proc_show(); monitor for absence of UAF-related crashes in dmesg under load.

Typical attack path

1. Establish or trigger an SMB session on a Linux client
2. Force or race the session into SES_EXITING teardown state
3. Read cifs statistics via procfs to trigger cifs_stats_proc_show()
4. Dereference freed session object causing UAF

How to detect it

Review kernel logs for UAF warnings or oops in cifs_stats_proc_show or related SMB functions; correlate with SMB session teardown events; inspect for unexpected process terminations or crashes tied to cifs activity.

What your security team should do

• Prioritize kernel updates on all SMB client systems within standard patch windows
• Restrict untrusted local access and limit procfs exposure where possible
• Monitor EPSS and KEV status for changes indicating increased exploit availability