Cloudanix VulnDB

CVE-2026-98175

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in how Linux handles network file connections can let an attacker crash the system or potentially run code by leaving behind a scheduled task that touches already-freed memory.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in Linux kernel SMB client where clean_demultiplex_info() frees the server structure while server->reconnect delayed work remains queued on cifsiod_wq, allowing later execution of smb2_reconnect_server() to read freed memory via server->srv_count.

Why it matters to the business

Kernel crashes or potential code execution on Linux systems acting as SMB clients, causing downtime for file-sharing workloads and exposing hosts to remote compromise when connecting to untrusted servers.

How an attack unfolds

An attacker forces repeated network disruptions against an SMB client connection to repeatedly queue reconnect work via cifs_queue_server_reconn(); when the demultiplex thread exits, only the echo work is canceled, the server object is freed, and the pending work later dereferences the freed structure.

How to fix it

Patch the kernel so that clean_demultiplex_info() calls cancel_delayed_work_sync on server->reconnect before kfree_sensitive(server), matching the existing behavior in cifs_put_tcp_session(). Reboot after applying the fix and verify the change in the CIFS module source.

How to confirm the fix worked

Inspect the clean_demultiplex_info() function in fs/smb/client/cifsfs.c (or equivalent) to confirm the added cancel_delayed_work_sync(&server->reconnect) call precedes the server free; test by reproducing connection flaps and confirming no UAF warnings in dmesg.

Typical attack path

  1. Initiate or maintain SMB/CIFS client connection to attacker-controlled server
  2. Induce socket errors or network flaps to trigger cifs_reconnect() and queue server->reconnect
  3. Force demultiplex thread exit while reconnect work is still pending
  4. Execute smb2_reconnect_server() on cifsiod_wq to perform UAF read

How to detect it

Search kernel logs and crash dumps for use-after-free reports or warnings referencing cifs_demultiplex_thread, clean_demultiplex_info, smb2_reconnect_server, or server->srv_count dereferences; correlate with SMB client activity around the time of the fault.

What your security team should do

  • Prioritize kernel updates on all Linux SMB client systems within the next patch cycle
  • Restrict SMB client connections to trusted servers only until patched
  • Enable kernel hardening features such as KASAN or slab freelist randomization in test environments to surface UAFs
  • Monitor kernel logs for cifs/smb module crashes or warnings

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in clean_demultiplex_info() clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued: cifs_demultiplex_thread() cifs_readv_from_socket() cifs_reconnect() __cifs_reconnect() cifs_queue_server_reconn() mod_delayed_work(cifsiod_wq, &server->reconnect, 0) clean_demultiplex_info() cancel_delayed_work_sync(&server->echo) // echo canceled // reconnect NOT canceled kfree_sensitive(server) // server freed ...later, on cifsiod_wq: smb2_reconnect_server() server->srv_count // UAF read of freed server Fix this by canceling server->reconnect delayed work in clean_demultiplex_info() before the server is freed, the same way cifs_put_tcp_session() already does.

Affected packages

Ecosystem Package Introduced Fixed