CVE-2024-35868

What it actually does

Use-after-free condition in cifs_stats_proc_write() when a session with status SES_EXITING is accessed during teardown.

Why it matters to the business

Linux systems using the SMB client may experience kernel instability or crashes; high ecosystem prevalence increases exposure for servers and embedded devices.

How an attack unfolds

An attacker with local access triggers concurrent session teardown and procfs write operations to reference freed session structures, leading to memory corruption.

How to fix it

Upgrade the Linux kernel to the commit 8fefd166fcb368c5fcf48238e3f7c8af829e0a72 or later stable releases containing the fix that skips SES_EXITING sessions.

How to confirm the fix worked

Verify the running kernel contains commit 8fefd166fcb368c5fcf48238e3f7c8af829e0a72 and test that cifs_stats_proc_write() no longer processes exiting sessions.

Typical attack path

1. Establish an SMB session via the CIFS client.
2. Trigger session exit by disconnecting or forcing teardown.
3. Simultaneously write to /proc/fs/cifs/Stats to invoke cifs_stats_proc_write().
4. Reference the freed session object to trigger the UAF.

How to detect it

Review kernel logs for UAF-related oops, slab corruption messages, or CIFS session teardown events coinciding with procfs writes.

What your security team should do

• Apply the kernel patch containing commit 8fefd166fcb368c5fcf48238e3f7c8af829e0a72 immediately on all affected systems.
• Monitor for kernel oops or panic events related to CIFS session handling.
• Restrict untrusted local access until patches are deployed.