CVE-2026-74608 (GCVE-0-2026-74608)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
Title
smb: client: Fix use-after-free in cifs_try_adding_channels()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory. Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cbc53148cc0946b72d62a3c53870cb22ce4ec284 , < 64d7584e62ac8cdc750455c5fdc6008fc2de4f06 (git)
Affected: cff97d683a083b862a8bb24309e0f4d2d928128a , < c292d4686f717c03e5022fc4ae7c782f39a94915 (git)
Affected: 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 , < 47dfac48bce7198ad4f1a388fc8c9491f878ac3b (git)
Affected: 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 , < 1ffacbadc14530e55b8d86f7b917524f6a0fb891 (git)
Affected: 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 , < 1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805 (git)
Affected: 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 , < 4986410316b1ae0e63c6ce418e4eb196723626e7 (git)
Affected: 22a6c5b3425f327e7f4c3606a72277dce82c7d83 (git)
Affected: 6.1.78 , < 6.1.183 (semver)
Affected: 6.6.17 , < 6.6.152 (semver)
Affected: 6.7.5 , < 6.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/sess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64d7584e62ac8cdc750455c5fdc6008fc2de4f06",
              "status": "affected",
              "version": "cbc53148cc0946b72d62a3c53870cb22ce4ec284",
              "versionType": "git"
            },
            {
              "lessThan": "c292d4686f717c03e5022fc4ae7c782f39a94915",
              "status": "affected",
              "version": "cff97d683a083b862a8bb24309e0f4d2d928128a",
              "versionType": "git"
            },
            {
              "lessThan": "47dfac48bce7198ad4f1a388fc8c9491f878ac3b",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "1ffacbadc14530e55b8d86f7b917524f6a0fb891",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "4986410316b1ae0e63c6ce418e4eb196723626e7",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22a6c5b3425f327e7f4c3606a72277dce82c7d83",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.183",
              "status": "affected",
              "version": "6.1.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.152",
              "status": "affected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/sess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "6.1.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_try_adding_channels()\n\ncifs_try_adding_channels() takes a temporary reference to an interface\nbefore dropping iface_lock. If cifs_ses_add_channel() fails, it drops\nthat reference and then increments iface-\u003eweight_fulfilled.\n\nA concurrent interface list refresh can remove the list reference while\nchannel creation is in progress. In that case, the failure-path\nkref_put() releases the last reference and frees iface. Updating\nweight_fulfilled afterward then accesses freed memory.\n\nIncrement weight_fulfilled before dropping the temporary reference,\nkeeping iface alive for the final access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the kernel SMB3 client multichannel path reached while handling remote SMB/CIFS server traffic (channel setup, reconnect, and FSCTL_QUERY_NETWORK_INTERFACE_INFO responses) over TCP, so a malicious or compromised SMB server can trigger it from the network.\nAC:L - A hostile SMB server can force cifs_ses_add_channel() to fail and concurrently drive interface-list refresh during the unlocked window; the attacker controls both sides of the race via reconnects, binding failures, and crafted interface responses with retries.\nPR:N - The attacker only needs to operate the malicious SMB server peer; no credentials, local shell access, or privileges on the victim host are required once the client has an SMB3 multichannel session to that server.\nUI:N - After an SMB3 multichannel mount exists, kernel delayed query_interfaces work, automatic reconnect on dropped TCP, and post-mount channel scaling invoke cifs_try_adding_channels() without further user action, letting the server trigger exploitation repeatedly.\nS:U - The UAF corrupts client kernel heap state within the same host kernel security authority and does not inherently cross a VM, container, or IOMMU security boundary.\nC:H - Writing to a freed cifs_server_iface slab object is a use-after-free; attacker-influenced heap grooming can reclaim the object and enable arbitrary kernel memory disclosure via corrupted or overlapping live allocations.\nI:H - The post-free weight_fulfilled increment is a kernel heap write after free that can corrupt adjacent slab objects and be leveraged into arbitrary write or control-flow hijacking through heap shaping.\nA:H - The use-after-free can cause KASAN-detectable slab corruption, kernel oops, or panic, and a malicious server can retrigger it by repeating failed channel opens with concurrent interface-list refresh on reconnect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:33.533Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06"
        },
        {
          "url": "https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915"
        },
        {
          "url": "https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891"
        },
        {
          "url": "https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805"
        },
        {
          "url": "https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7"
        }
      ],
      "title": "smb: client: Fix use-after-free in cifs_try_adding_channels()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74608",
    "datePublished": "2026-08-22T15:31:55.298Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:33.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74608",
      "date": "2026-09-20",
      "epss": "0.00477",
      "percentile": "0.40361"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:47:39.000Z",
      "cve": "CVE-2026-74608",
      "id": "msrc_CVE-2026-74608",
      "initial_release_date": "2026-08-24T01:04:21.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: Fix use-after-free in cifs_try_adding_channels()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74608.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/sess.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "64d7584e62ac8cdc750455c5fdc6008fc2de4f06",
                    "status": "affected",
                    "version": "cbc53148cc0946b72d62a3c53870cb22ce4ec284",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c292d4686f717c03e5022fc4ae7c782f39a94915",
                    "status": "affected",
                    "version": "cff97d683a083b862a8bb24309e0f4d2d928128a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47dfac48bce7198ad4f1a388fc8c9491f878ac3b",
                    "status": "affected",
                    "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1ffacbadc14530e55b8d86f7b917524f6a0fb891",
                    "status": "affected",
                    "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805",
                    "status": "affected",
                    "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4986410316b1ae0e63c6ce418e4eb196723626e7",
                    "status": "affected",
                    "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "22a6c5b3425f327e7f4c3606a72277dce82c7d83",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.183",
                    "status": "affected",
                    "version": "6.1.78",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.152",
                    "status": "affected",
                    "version": "6.6.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "affected",
                    "version": "6.7.5",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/sess.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.152",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_try_adding_channels()\n\ncifs_try_adding_channels() takes a temporary reference to an interface\nbefore dropping iface_lock. If cifs_ses_add_channel() fails, it drops\nthat reference and then increments iface-\u003eweight_fulfilled.\n\nA concurrent interface list refresh can remove the list reference while\nchannel creation is in progress. In that case, the failure-path\nkref_put() releases the last reference and frees iface. Updating\nweight_fulfilled afterward then accesses freed memory.\n\nIncrement weight_fulfilled before dropping the temporary reference,\nkeeping iface alive for the final access."
          }
        ],
        "id": "CVE-2026-74608",
        "lastModified": "2026-08-25T06:18:37.637",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-22T16:16:33.290",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:50:42+00:00",
      "cve": "CVE-2026-74608",
      "id": "CVE-2026-74608",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: Fix use-after-free in cifs_try_adding_channels()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74608.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:17:56Z",
      "cve": "CVE-2026-74608",
      "id": "CVE-2026-74608",
      "initial_release_date": "2026-09-01T13:28:22Z",
      "product_status:known_affected": "134",
      "product_status:known_not_affected": "223",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74608",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74608.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.