CVE-2024-44992

What it actually does

Potential NULL pointer dereference in cifs_free_subrequest() when rdata->credits.value is nonzero but rdata->server is NULL, causing add_credits_and_wake_if() to call ops->add_credits on a null server pointer and crash the kernel.

Why it matters to the business

Unexpected system crashes or instability during SMB/CIFS file operations can interrupt services, cause data loss in flight, and require reboots, especially on systems using the Linux SMB client.

How an attack unfolds

An attacker with local access triggers SMB read/write paths that reach the credit accounting code with a partially initialized rdata structure; under the race or error condition where server is NULL, the dereference occurs and panics the kernel.

How to fix it

Upgrade the Linux kernel to 6.10.7 or later, or apply the fix commit fead60a6d5f84b472b928502a42c419253afe6c1. Docker users should update to a patched release (25.0.6, 23.0.15, 26.1.5, or 27.1.1) that incorporates the fixed kernel.

How to confirm the fix worked

Confirm the running kernel contains commit fead60a6d5f84b472b928502a42c419253afe6c1 or is version 6.10.7 or newer; recompile with scan-build to verify the NULL check is present; test SMB workloads that previously triggered the warning.

Typical attack path

1. Obtain local access on a Linux system using the CIFS client
2. Trigger SMB read or write requests that exercise the credit tracking added in commit 519be989717c
3. Force the specific state where rdata->credits.value != 0 and rdata->server == NULL
4. Cause kernel panic via the resulting NULL dereference in add_credits_and_wake_if()

How to detect it

Review kernel logs for oops or panic messages containing cifs_free_subrequest, add_credits_and_wake_if, or NULL dereference in the CIFS credit path; correlate with SMB client activity around the time of the crash.

What your security team should do

• Prioritize kernel upgrades on all systems exposing the CIFS client, especially those with high SMB traffic
• Monitor for kernel oops/panic reports referencing cifs_free_subrequest or add_credits_and_wake_if
• Apply the exact fixed versions listed for docker and kernel packages