CVE-2026-98173 (GCVE-0-2026-98173)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:44 – Updated: 2026-10-07 06:49
VLAI
Title
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels() cifs_try_adding_channels() iterates ses->iface_list with list_for_each_entry_safe_from(), which captures the next entry (niface) under iface_lock. The loop body then drops iface_lock for the whole duration of cifs_ses_add_channel(). A concurrent interface refresh (SMB3_request_interfaces() -> parse_server_interfaces()) marks all ifaces inactive and removes and frees any that are not re-advertised via list_del() + kref_put(), where release_iface() is a bare kfree(). Since niface typically has no channel holding a reference, the list reference is its last and it can be freed inside the unlocked window. On continue, the iterator advance step then dereferences niface->iface_head.next, and the loop body reads iface->rdma_capable/is_active, both on freed memory. Fix this by never keeping an unreferenced list pointer across the unlocked window. Each channel attempt now re-scans the list from the head under iface_lock, takes a kref on the selected candidate, and passes only that referenced candidate to cifs_ses_add_channel(). weight_fulfilled still tracks selection progress, so restarting the scan preserves the original weighted distribution and the weight_fulfilled-before-kref_put ordering on the failure path. Add a per-pass attempts cap so a flapping interface refresh cannot keep the inner loop spinning within a single tries increment.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6633 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aa45dadd34e44fcd6a9df4b395bee5b5633b4cec , < c941f1ebfd26f683de81091473f3596a218abff0 (git)
Affected: aa45dadd34e44fcd6a9df4b395bee5b5633b4cec , < e99040e5e9c60441e6b4725e1a7b88c3106ae903 (git)
Affected: aa45dadd34e44fcd6a9df4b395bee5b5633b4cec , < ec36b38e65596950e6c29bed7dfc90b98707c19c (git)
Affected: aa45dadd34e44fcd6a9df4b395bee5b5633b4cec , < d034e836eefd7ce75e588f7031cffbeec594f5ac (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/sess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c941f1ebfd26f683de81091473f3596a218abff0",
              "status": "affected",
              "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
              "versionType": "git"
            },
            {
              "lessThan": "e99040e5e9c60441e6b4725e1a7b88c3106ae903",
              "status": "affected",
              "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
              "versionType": "git"
            },
            {
              "lessThan": "ec36b38e65596950e6c29bed7dfc90b98707c19c",
              "status": "affected",
              "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
              "versionType": "git"
            },
            {
              "lessThan": "d034e836eefd7ce75e588f7031cffbeec594f5ac",
              "status": "affected",
              "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/sess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of iface in cifs_try_adding_channels()\n\ncifs_try_adding_channels() iterates ses-\u003eiface_list with\nlist_for_each_entry_safe_from(), which captures the next entry\n(niface) under iface_lock.  The loop body then drops iface_lock for\nthe whole duration of cifs_ses_add_channel().\n\nA concurrent interface refresh (SMB3_request_interfaces() -\u003e\nparse_server_interfaces()) marks all ifaces inactive and removes and\nfrees any that are not re-advertised via list_del() + kref_put(),\nwhere release_iface() is a bare kfree().  Since niface typically has\nno channel holding a reference, the list reference is its last and it\ncan be freed inside the unlocked window.  On continue, the iterator\nadvance step then dereferences niface-\u003eiface_head.next, and the loop\nbody reads iface-\u003erdma_capable/is_active, both on freed memory.\n\nFix this by never keeping an unreferenced list pointer across the\nunlocked window.  Each channel attempt now re-scans the list from the\nhead under iface_lock, takes a kref on the selected candidate, and\npasses only that referenced candidate to cifs_ses_add_channel().\nweight_fulfilled still tracks selection progress, so restarting the\nscan preserves the original weighted distribution and the\nweight_fulfilled-before-kref_put ordering on the failure path.\n\nAdd a per-pass attempts cap so a flapping interface refresh cannot\nkeep the inner loop spinning within a single tries increment."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious SMB server sends the bad data over TCP/445 in its FSCTL_QUERY_NETWORK_INTERFACE_INFO responses. A later response leaves out an interface, so parse_server_interfaces() does list_del() and kref_put() and frees it. cifs_try_adding_channels() still holds niface after dropping iface_lock for cifs_ses_add_channel(), and that pointer now refers to freed memory.\nAC:H - Multichannel is off by default (multichannel=false, max_channels=1), so the victim must mount with multichannel or max_channels\u003e1. The server also has to line up a refresh from the 600s smb2_query_server_interfaces worker with the unlocked add-channel window. It can stall channel setup and force reconnects to retry, but it does not schedule the worker.\nPR:N - The attacker only runs a rogue SMB server and needs no account or privilege on the victim client. The interface list is server-supplied data the client trusts during the session it opened.\nUI:R - A victim or admin has to mount a share from the attacker\u0027s server with multichannel turned on. CIFS mounts are not FS_USERNS_MOUNT, so the attacker cannot set up the client side alone.\nS:U - The memory corruption stays inside the client kernel\u0027s own security authority. No VM or other trust boundary is crossed.\nC:H - The loop continues through freed niface-\u003eiface_head.next and reads iface-\u003erdma_capable, is_active, speed and sockaddr from the freed cifs_server_iface. The attacker can refill that heap object with their own data, which lets the kernel follow attacker-chosen pointers.\nI:H - Once the freed entry is reallocated, the loop does kref_get() and weight_fulfilled++/num_channels++ through the stale or forged iface pointer. That is a kernel write at a location the attacker influences, and cifs_ses_add_channel() then uses the forged object.\nA:H - Dereferencing the freed list entry in cifs_try_adding_channels() can oops or panic the client. The server can force reconnects to re-enter this path repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:49:22.240Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c941f1ebfd26f683de81091473f3596a218abff0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e99040e5e9c60441e6b4725e1a7b88c3106ae903"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec36b38e65596950e6c29bed7dfc90b98707c19c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d034e836eefd7ce75e588f7031cffbeec594f5ac"
        }
      ],
      "title": "smb: client: fix use-after-free of iface in cifs_try_adding_channels()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98173",
    "datePublished": "2026-10-06T08:44:17.567Z",
    "dateReserved": "2026-09-25T10:25:14.322Z",
    "dateUpdated": "2026-10-07T06:49:22.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98173",
      "date": "2026-10-08",
      "epss": "0.00325",
      "percentile": "0.23577"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/sess.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c941f1ebfd26f683de81091473f3596a218abff0",
                    "status": "affected",
                    "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e99040e5e9c60441e6b4725e1a7b88c3106ae903",
                    "status": "affected",
                    "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ec36b38e65596950e6c29bed7dfc90b98707c19c",
                    "status": "affected",
                    "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d034e836eefd7ce75e588f7031cffbeec594f5ac",
                    "status": "affected",
                    "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/sess.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of iface in cifs_try_adding_channels()\n\ncifs_try_adding_channels() iterates ses-\u003eiface_list with\nlist_for_each_entry_safe_from(), which captures the next entry\n(niface) under iface_lock.  The loop body then drops iface_lock for\nthe whole duration of cifs_ses_add_channel().\n\nA concurrent interface refresh (SMB3_request_interfaces() -\u003e\nparse_server_interfaces()) marks all ifaces inactive and removes and\nfrees any that are not re-advertised via list_del() + kref_put(),\nwhere release_iface() is a bare kfree().  Since niface typically has\nno channel holding a reference, the list reference is its last and it\ncan be freed inside the unlocked window.  On continue, the iterator\nadvance step then dereferences niface-\u003eiface_head.next, and the loop\nbody reads iface-\u003erdma_capable/is_active, both on freed memory.\n\nFix this by never keeping an unreferenced list pointer across the\nunlocked window.  Each channel attempt now re-scans the list from the\nhead under iface_lock, takes a kref on the selected candidate, and\npasses only that referenced candidate to cifs_ses_add_channel().\nweight_fulfilled still tracks selection progress, so restarting the\nscan preserves the original weighted distribution and the\nweight_fulfilled-before-kref_put ordering on the failure path.\n\nAdd a per-pass attempts cap so a flapping interface refresh cannot\nkeep the inner loop spinning within a single tries increment."
          }
        ],
        "id": "CVE-2026-98173",
        "lastModified": "2026-10-07T07:17:03.737",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:17:59.060",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c941f1ebfd26f683de81091473f3596a218abff0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d034e836eefd7ce75e588f7031cffbeec594f5ac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e99040e5e9c60441e6b4725e1a7b88c3106ae903"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ec36b38e65596950e6c29bed7dfc90b98707c19c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-08T08:52:13+00:00",
      "cve": "CVE-2026-98173",
      "id": "CVE-2026-98173",
      "initial_release_date": "2026-10-06T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix use-after-free of iface in cifs_try_adding_channels()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98173.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-07T16:28:34Z",
      "cve": "CVE-2026-98173",
      "id": "CVE-2026-98173",
      "initial_release_date": "2026-10-07T16:28:34Z",
      "product_status:known_affected": "204",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98173",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98173.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.