CVE-2024-35869

What it actually does

Use-after-free in the Linux kernel SMB client when walking DFS referrals, mounting, or performing DFS failover because child sessions from parent tcon->ses are not properly refcounted.

Why it matters to the business

Linux systems using SMB/CIFS mounts with DFS can experience kernel crashes, memory corruption, or local code execution, leading to downtime, data loss, or compromise of file servers and clients.

How an attack unfolds

An attacker with local access triggers DFS referral processing or failover on an SMB mount; the missing refcounts allow a freed session object to be dereferenced during tcon traversal, enabling use-after-free exploitation.

How to fix it

Update the Linux kernel to the fixed commit 457391b0380335d5e9a5babdec90ac53928b23b4 or later equivalent stable release containing the refcounting changes for tcon->ses children.

How to confirm the fix worked

Verify the running kernel contains commit 457391b0380335d5e9a5babdec90ac53928b23b4 via git log or uname; test SMB DFS mounts to confirm no crashes during referral failover.

Typical attack path

1. Obtain local access to a Linux system with SMB client configured for DFS
2. Trigger DFS referral walking or mount/failover operations via crafted SMB shares or network conditions
3. Exploit the use-after-free during session reference handling to corrupt kernel memory or execute code

How to detect it

Review kernel logs for use-after-free warnings or crashes in cifs.ko during SMB mount or DFS operations; look for unexpected session teardown patterns in dmesg or /var/log/kern.log around the time of file share activity.

What your security team should do

• Prioritize kernel upgrades on all Linux systems using SMB DFS mounts within the next patching cycle
• Disable DFS functionality where not required via mount options as a temporary mitigation
• Monitor for kernel oops or panic logs related to cifs/smb during network file operations