Cloudanix VulnDB

CVE-2026-98174

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the way Linux handles file sharing connections over the network can let attackers crash the system or potentially gain elevated access when multiple reconnection attempts happen at once.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper list initialization of TCP_Server_Info.rlist via kzalloc leaves next/prev as NULL instead of self-referential, violating list_empty() semantics and enabling NULL pointer dereference on list_add(); concurrent cifs_signal_cifsd_for_reconnect() calls from multiple cifsd threads can insert the same node twice, corrupting the list.

Why it matters to the business

Kernel memory corruption in the SMB/CIFS client can cause system crashes, data corruption, or potential privilege escalation on Linux systems performing network file operations, leading to downtime and possible unauthorized access.

How an attack unfolds

An attacker triggers concurrent reconnection signaling from multiple cifsd threads against an SMB server while the rlist structure is being initialized, exploiting the missing self-referential pointers and lack of synchronization to corrupt the list and achieve memory safety violations.

How to fix it

Apply the upstream kernel patch that properly initializes rlist with INIT_LIST_HEAD and adds locking around cifs_signal_cifsd_for_reconnect; rebuild and reboot affected Linux kernels.

How to confirm the fix worked

Confirm the fix by inspecting the TCP_Server_Info structure initialization for INIT_LIST_HEAD usage and verifying mutual exclusion around reconnection signaling in the CIFS module source or running targeted concurrency tests.

Typical attack path

  1. Establish multiple concurrent SMB/CIFS sessions that invoke cifs_signal_cifsd_for_reconnect
  2. Force rlist allocation through kzalloc without proper list initialization
  3. Race the list_add operations to insert the same node twice or dereference NULL prev pointers
  4. Trigger kernel list corruption leading to panic or controlled memory writes

How to detect it

Review kernel logs for NULL pointer dereferences or list corruption warnings involving cifs or TCP_Server_Info; examine stack traces referencing rlist or cifs_signal_cifsd_for_reconnect during SMB activity.

What your security team should do

  • Prioritize kernel updates for all Linux systems using the CIFS/SMB client within the next patching cycle
  • Monitor for kernel oops or list corruption events in dmesg on SMB-connected hosts
  • Restrict untrusted SMB server connections until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_empty() always return false and list_add() dereference a NULL ->prev pointer. Also, cifs_signal_cifsd_for_reconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.

Affected packages

Ecosystem Package Introduced Fixed