Cloudanix VulnDB

CVE-2026-98173

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's file-sharing code can let an attacker on the network crash the computer or potentially take control during normal connection setup.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in cifs_try_adding_channels() caused by holding a list iterator across an unlocked window while a concurrent SMB3_request_interfaces() parse_server_interfaces() frees iface entries via list_del + kref_put + kfree in release_iface().

Why it matters to the business

Potential kernel panic, memory corruption, or local privilege escalation during SMB client channel management on systems mounting remote shares; low exploitability and 17-day-old disclosure with stable low EPSS reduce immediate operational urgency.

How an attack unfolds

An attacker with network adjacency triggers repeated SMB interface advertisement changes while the victim client is establishing additional channels; the race frees a list entry that the iterator later dereferences, leading to arbitrary read/write or crash inside the unlocked cifs_ses_add_channel() window.

How to fix it

Upgrade the Linux kernel to a version containing the fix that re-scans the iface_list under lock, takes a kref on each candidate, and caps inner-loop attempts; apply vendor backports if available.

How to confirm the fix worked

Confirm the patched kernel source no longer retains unreferenced list pointers across the unlocked section of cifs_try_adding_channels(); verify with reproducer that no UAF occurs under concurrent interface refresh.

Typical attack path

  1. Establish SMB session and begin cifs_try_adding_channels() under iface_lock
  2. Drop iface_lock and enter cifs_ses_add_channel()
  3. Trigger concurrent interface refresh that removes and frees niface
  4. Iterator resumes and dereferences freed niface->iface_head.next or iface fields
  5. Kernel memory corruption or panic occurs

How to detect it

Inspect kernel logs and crash dumps for stack traces containing cifs_try_adding_channels, list_for_each_entry_safe_from, parse_server_interfaces, or release_iface; correlate with SMB3 interface refresh events.

  • cifs_try_adding_channels
  • release_iface
  • parse_server_interfaces
  • list_for_each_entry_safe_from

What your security team should do

  • Prioritize kernel updates on all SMB client systems within standard patch windows given low EPSS and no KEV listing
  • Monitor upstream stable branches for the specific commit that eliminates cross-window list pointers
  • Restrict SMB multichannel usage to trusted networks until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels() cifs_try_adding_channels() iterates ses->iface_list with list_for_each_entry_safe_from(), which captures the next entry (niface) under iface_lock. The loop body then drops iface_lock for the whole duration of cifs_ses_add_channel(). A concurrent interface refresh (SMB3_request_interfaces() -> parse_server_interfaces()) marks all ifaces inactive and removes and frees any that are not re-advertised via list_del() + kref_put(), where release_iface() is a bare kfree(). Since niface typically has no channel holding a reference, the list reference is its last and it can be freed inside the unlocked window. On continue, the iterator advance step then dereferences niface->iface_head.next, and the loop body reads iface->rdma_capable/is_active, both on freed memory. Fix this by never keeping an unreferenced list pointer across the unlocked window. Each channel attempt now re-scans the list from the head under iface_lock, takes a kref on the selected candidate, and passes only that referenced candidate to cifs_ses_add_channel(). weight_fulfilled still tracks selection progress, so restarting the scan preserves the original weighted distribution and the weight_fulfilled-before-kref_put ordering on the failure path. Add a per-pass attempts cap so a flapping interface refresh cannot keep the inner loop spinning within a single tries increment.

Affected packages

Ecosystem Package Introduced Fixed