CVE-2026-43239

What it actually does

This is a race condition in the Linux kernel SMB/CIFS client interface-discovery path. Concurrent SMB client query-interface work items could update shared interface state without consistently holding the appropriate lock, allowing inconsistent state or memory-safety side effects inside the kernel. Because the affected code runs in kernel context, successful exploitation could plausibly lead to denial of service through a kernel crash and, depending on kernel build, timing, and surrounding memory state, may create risk of privilege-impacting memory corruption. The CVSS vector indicates network reachability with user interaction, meaning a target system generally must initiate or be induced to initiate an SMB client connection to a server that can influence the vulnerable code path.

Why it matters to the business

Systems that mount or access SMB/CIFS shares from Linux may be exposed if they connect to a malicious or compromised SMB server. A successful attack could crash affected Linux systems or potentially compromise confidentiality and integrity at the operating-system level, disrupting file access, workloads, and services that depend on SMB-mounted storage. EPSS is currently low and there is no known KEV listing or public exploit maturity reported, but the high CVSS score and kernel-level impact make timely patching important, especially on endpoints, servers, containers, or appliances that use SMB/CIFS mounts.

How an attack unfolds

An attacker would first need to control or impersonate an SMB server, compromise an existing SMB file server, or lure a user or automated process on a vulnerable Linux system into connecting to an attacker-controlled SMB share. During SMB session setup or subsequent interface-discovery activity, the malicious server would attempt to trigger overlapping query-interface operations so that two kernel work items concurrently update the SMB client interface state. If the race is won, the kernel may process inconsistent interface metadata or corrupt internal state, potentially causing a crash or other unintended kernel behavior. Exploitation is likely timing-sensitive and dependent on the exact kernel version, SMB client configuration, CPU scheduling, and network behavior.

How to fix it

Upgrade affected Linux kernels to a vendor release that includes the upstream fix for the SMB client query_interfaces race, specifically the change that checks and updates iface_last_update while holding iface_lock. Because no exact fixed package versions were provided, use the security advisory from the relevant Linux distribution or kernel vendor to identify the first fixed kernel for each supported branch. Prioritize systems that mount SMB/CIFS shares, automatically connect to file shares, or allow users to access arbitrary SMB paths. Where immediate patching is not possible, reduce exposure by disabling unnecessary CIFS/SMB client usage, restricting outbound SMB traffic to trusted file servers only, preventing automatic mounting of untrusted SMB shares, and monitoring for kernel crashes or anomalous SMB client behavior.

How to confirm the fix worked

Confirm exposure by inventorying Linux systems and checking whether they run a kernel build predating the vendor fix for the SMB client query_interfaces locking issue. Validate remediation by confirming the installed kernel package version is at or above the distribution's fixed version and that the system has rebooted into the patched kernel. Operationally, verify that SMB/CIFS mounts still function after patching and that kernel logs no longer show CIFS/SMB client warnings, kernel oopses, panics, or stack traces involving query_interfaces or related SMB client interface-update code. Network controls can be validated by confirming outbound TCP/445 access is limited to approved SMB servers.

Typical attack path

1. Identify Linux systems that use the kernel SMB/CIFS client to access SMB shares.
2. Obtain control of an SMB server the target connects to, or induce the target to connect to an attacker-controlled SMB share.
3. Trigger SMB client interface-discovery behavior that invokes concurrent query-interface work.
4. Manipulate timing and server responses to increase the chance of overlapping updates to SMB client interface state.
5. Use the resulting race condition to cause kernel instability, denial of service, or potentially further memory-corruption effects depending on exploitability.

How to detect it

Look for evidence that Linux SMB clients connected to untrusted or unusual SMB servers followed by kernel instability. Primary log sources include kernel logs, system journal, syslog, crash dump records, endpoint telemetry, network flow logs, DNS logs, proxy/firewall logs for outbound TCP/445, and authentication/file-server logs showing unexpected SMB sessions. Search for kernel oopses, panics, warnings, or stack traces involving CIFS, SMB3, query_interfaces, interface updates, or worker threads shortly after SMB connections. Investigate outbound SMB connections to newly observed, external, user-controlled, or geographically unusual destinations. If crash dumps are available, inspect stack traces for SMB client interface-discovery functions and concurrent workqueue activity. There are no publicly described payload-level indicators for this vulnerability, so detection should emphasize behavioral correlation: suspicious SMB destination plus kernel CIFS/SMB client errors or crashes.

• query_interfaces
• iface_last_update
• iface_lock
• CIFS:
• SMB3:
• cifs_mount
• mount.cifs
• kernel: CIFS
• kernel: SMB3
• BUG: kernel NULL pointer dereference
• Oops:
• Kernel panic
• Workqueue: cifsiod
• tcp/445

What your security team should do

• Patch or upgrade Linux kernels on systems that use SMB/CIFS mounts, prioritizing internet-facing workloads, user workstations, file-processing systems, and servers with automated SMB mounts.
• Use vendor advisories to map each distribution and kernel branch to the exact fixed package version, then verify systems have rebooted into the fixed kernel.
• Restrict outbound SMB traffic, especially TCP/445, so Linux clients can connect only to approved SMB servers.
• Audit SMB/CIFS mount configurations, automount rules, desktop file-manager integrations, and scripts that may connect to untrusted SMB shares.
• Monitor kernel logs and SIEM telemetry for CIFS/SMB client errors, kernel oopses, panics, or stack traces around interface query handling.
• Treat unexpected Linux client connections to unknown SMB servers as suspicious and investigate the initiating process, user, and destination.
• Because there is no KEV listing, ransomware association, or known exploit maturity reported, prioritize based on SMB usage and business criticality rather than emergency internet-wide exploitation assumptions.