CVE-2026-89636

What it actually does

Use-after-free caused by ce->tgthint retaining a pointer to a freed cache_dfs_tgt structure after free_tgts() empties ce->tlist, enabling memory corruption or arbitrary code execution on later dereference in the Linux SMB client.

Why it matters to the business

Remote attackers can crash Linux systems or execute code with kernel privileges, disrupting file sharing, network storage access, and any services relying on SMB/CIFS mounts; stable low EPSS indicates limited current exploitation but high CVSS demands prompt attention.

How an attack unfolds

An attacker interacts with an SMB server that triggers DFS target list freeing (via mount, referral, or connection teardown), leaving tgthint dangling; subsequent SMB operations dereference the freed memory, leading to UAF that can be groomed for code execution.

How to fix it

Apply the upstream kernel patch that sets ce->tgthint to NULL inside free_tgts() after freeing list elements; upgrade to a kernel containing the fix for the affected SMB client code.

How to confirm the fix worked

Verify the presence of the NULL assignment to tgthint in free_tgts() via source inspection or kernel version check; confirm no dangling pointer remains after list free operations.

Typical attack path

1. Establish SMB connection or trigger DFS referral handling
2. Force conditions that call free_tgts() on the target list
3. Reuse the stale tgthint pointer in later SMB client code paths
4. Leverage UAF for memory corruption and privilege escalation or DoS

How to detect it

Review kernel logs and SMB client traces for crashes or oops involving cache_dfs_tgt or tgthint structures; look for unexpected memory corruption patterns during SMB DFS operations.

What your security team should do

• Prioritize kernel updates for all Linux systems using SMB client mounts
• Monitor for new kernel releases addressing this UseAfterFree
• Restrict untrusted SMB servers or disable DFS referrals where feasible until patched