CVE-2026-98175 (GCVE-0-2026-98175)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:44 – Updated: 2026-10-07 06:49
VLAI
Title
smb: client: cancel reconnect work in clean_demultiplex_info()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in clean_demultiplex_info() clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued: cifs_demultiplex_thread() cifs_readv_from_socket() cifs_reconnect() __cifs_reconnect() cifs_queue_server_reconn() mod_delayed_work(cifsiod_wq, &server->reconnect, 0) clean_demultiplex_info() cancel_delayed_work_sync(&server->echo) // echo canceled // reconnect NOT canceled kfree_sensitive(server) // server freed ...later, on cifsiod_wq: smb2_reconnect_server() server->srv_count // UAF read of freed server Fix this by canceling server->reconnect delayed work in clean_demultiplex_info() before the server is freed, the same way cifs_put_tcp_session() already does.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6624 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b , < 180380272f116dbd2b0354c5c7872e112e519149 (git)
Affected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b , < e3f6a779433d13aafb5edab59e4f9313051e8a52 (git)
Affected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b , < 7ab9ceedd860216fb97f2d8574cbe58b8906f42a (git)
Affected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b , < 2e5103e11a17c274715dd56cf185eeedccf686b8 (git)
Affected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b , < c65eae6f61d1778ff7a82e4aae4080e26f486af1 (git)
Affected: e008a962311a875a828cbae54b43285858aaa6c8 (git)
Affected: 123b228a09b90b50b0a9d6eb8294cf0c42efc029 (git)
Affected: 0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9 (git)
Affected: d0d2a4c82942e2f51e4984beea1f7e5a994bd06c (git)
Affected: 15a12fbbf365a483b1c19f9caeb707b3bea77e10 (git)
Affected: f0b715409cb9cf7e21e690f9b163047739761962 (git)
Affected: ff04da387c10b6bf7b510392742c8cd46c130fd6 (git)
Affected: 48f9526f4dcb4b132fe0dc2450835311e3b013a6 (git)
Affected: 3.10.107 , < 3.11 (semver)
Affected: 3.12.70 , < 3.13 (semver)
Affected: 3.16.42 , < 3.17 (semver)
Affected: 3.18.47 , < 3.19 (semver)
Affected: 4.1.38 , < 4.2 (semver)
Affected: 4.4.40 , < 4.5 (semver)
Affected: 4.8.16 , < 4.9 (semver)
Affected: 4.9.1 , < 4.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.10
Unaffected: 0 , < 4.10 (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "180380272f116dbd2b0354c5c7872e112e519149",
              "status": "affected",
              "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
              "versionType": "git"
            },
            {
              "lessThan": "e3f6a779433d13aafb5edab59e4f9313051e8a52",
              "status": "affected",
              "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
              "versionType": "git"
            },
            {
              "lessThan": "7ab9ceedd860216fb97f2d8574cbe58b8906f42a",
              "status": "affected",
              "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
              "versionType": "git"
            },
            {
              "lessThan": "2e5103e11a17c274715dd56cf185eeedccf686b8",
              "status": "affected",
              "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
              "versionType": "git"
            },
            {
              "lessThan": "c65eae6f61d1778ff7a82e4aae4080e26f486af1",
              "status": "affected",
              "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e008a962311a875a828cbae54b43285858aaa6c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "123b228a09b90b50b0a9d6eb8294cf0c42efc029",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d0d2a4c82942e2f51e4984beea1f7e5a994bd06c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "15a12fbbf365a483b1c19f9caeb707b3bea77e10",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f0b715409cb9cf7e21e690f9b163047739761962",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ff04da387c10b6bf7b510392742c8cd46c130fd6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "48f9526f4dcb4b132fe0dc2450835311e3b013a6",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.107",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.70",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.42",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.47",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.38",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.40",
              "versionType": "semver"
            },
            {
              "lessThan": "4.9",
              "status": "affected",
              "version": "4.8.16",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.70",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.40",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.8.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: cancel reconnect work in clean_demultiplex_info()\n\nclean_demultiplex_info() cancels server-\u003eecho delayed work but not\nserver-\u003ereconnect, which can cause a use-after-free when the\ndemultiplex thread exits while a reconnect work is still queued:\n\n  cifs_demultiplex_thread()\n    cifs_readv_from_socket()\n      cifs_reconnect()\n        __cifs_reconnect()\n          cifs_queue_server_reconn()\n            mod_delayed_work(cifsiod_wq, \u0026server-\u003ereconnect, 0)\n    clean_demultiplex_info()\n      cancel_delayed_work_sync(\u0026server-\u003eecho)   // echo canceled\n                                                 // reconnect NOT canceled\n      kfree_sensitive(server)                    // server freed\n\n  ...later, on cifsiod_wq:\n\n  smb2_reconnect_server()\n    server-\u003esrv_count  // UAF read of freed server\n\nFix this by canceling server-\u003ereconnect delayed work in\nclean_demultiplex_info() before the server is freed, the same way\ncifs_put_tcp_session() already does."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The SMB server at the other end of the client\u0027s TCP connection triggers the bug. When it resets the connection or sends an oversized SMB response, cifs_demultiplex_thread() calls cifs_reconnect() and then __cifs_reconnect(), which queues server-\u003ereconnect via cifs_queue_server_reconn(). clean_demultiplex_info() then frees the server without cancelling that work.\nAC:H - The malicious server can force reconnects whenever it likes. The free, though, only happens when the client drops its last TCP session reference (umount or a session put, via cifs_put_tcp_session) inside the window where __cifs_reconnect has re-queued the reconnect work. Then smb2_reconnect_server must run after kfree(server). The server cannot produce that client-side timing on demand.\nPR:N - A remote SMB server needs no credentials on the client host to drop its own connection or send a malformed response that drives the client into __cifs_reconnect. Mounting locally is not a lower-privilege route: cifs_fs_type has no FS_USERNS_MOUNT, so a local attacker would need real CAP_SYS_ADMIN.\nUI:R - The client has to mount a share from the attacker\u0027s SMB server, and a demultiplex thread only exists after that mount. The free also needs the client to unmount or otherwise drop the session at the wrong moment.\nS:U - The freed struct TCP_Server_Info and the cifsiod_wq worker that uses it after free are both in the client kernel. No VM, IOMMU or sandbox boundary is crossed.\nC:H - smb2_reconnect_server() reads server-\u003esrv_count from the freed TCP_Server_Info. If a reallocated object puts a nonzero value there, the worker carries on and dereferences primary_server, the reconnect_mutex and the session lists, all of which a heap spray would control.\nI:H - With a nonzero srv_count in reclaimed memory, the worker increments it, takes reconnect_mutex, manipulates the ses and tcon lists and calls cifs_put_tcp_session on the stale pointer. Those are writes through attacker-shaped memory, so they can corrupt kernel data.\nA:H - syzbot reproduced this use-after-free of TCP_Server_Info in smb2_reconnect_server. A stale worker running on the shared cifsiod_wq workqueue can oops or panic the client kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:49:24.554Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"
        }
      ],
      "title": "smb: client: cancel reconnect work in clean_demultiplex_info()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98175",
    "datePublished": "2026-10-06T08:44:19.155Z",
    "dateReserved": "2026-09-25T10:25:14.322Z",
    "dateUpdated": "2026-10-07T06:49:24.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98175",
      "date": "2026-10-08",
      "epss": "0.00325",
      "percentile": "0.23577"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/connect.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "180380272f116dbd2b0354c5c7872e112e519149",
                    "status": "affected",
                    "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e3f6a779433d13aafb5edab59e4f9313051e8a52",
                    "status": "affected",
                    "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ab9ceedd860216fb97f2d8574cbe58b8906f42a",
                    "status": "affected",
                    "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2e5103e11a17c274715dd56cf185eeedccf686b8",
                    "status": "affected",
                    "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c65eae6f61d1778ff7a82e4aae4080e26f486af1",
                    "status": "affected",
                    "version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e008a962311a875a828cbae54b43285858aaa6c8",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "123b228a09b90b50b0a9d6eb8294cf0c42efc029",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d0d2a4c82942e2f51e4984beea1f7e5a994bd06c",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "15a12fbbf365a483b1c19f9caeb707b3bea77e10",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "f0b715409cb9cf7e21e690f9b163047739761962",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ff04da387c10b6bf7b510392742c8cd46c130fd6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "48f9526f4dcb4b132fe0dc2450835311e3b013a6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "affected",
                    "version": "3.10.107",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "affected",
                    "version": "3.12.70",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.17",
                    "status": "affected",
                    "version": "3.16.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "affected",
                    "version": "3.18.47",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "affected",
                    "version": "4.1.38",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.5",
                    "status": "affected",
                    "version": "4.4.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "affected",
                    "version": "4.8.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "affected",
                    "version": "4.9.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/connect.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.10"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: cancel reconnect work in clean_demultiplex_info()\n\nclean_demultiplex_info() cancels server-\u003eecho delayed work but not\nserver-\u003ereconnect, which can cause a use-after-free when the\ndemultiplex thread exits while a reconnect work is still queued:\n\n  cifs_demultiplex_thread()\n    cifs_readv_from_socket()\n      cifs_reconnect()\n        __cifs_reconnect()\n          cifs_queue_server_reconn()\n            mod_delayed_work(cifsiod_wq, \u0026server-\u003ereconnect, 0)\n    clean_demultiplex_info()\n      cancel_delayed_work_sync(\u0026server-\u003eecho)   // echo canceled\n                                                 // reconnect NOT canceled\n      kfree_sensitive(server)                    // server freed\n\n  ...later, on cifsiod_wq:\n\n  smb2_reconnect_server()\n    server-\u003esrv_count  // UAF read of freed server\n\nFix this by canceling server-\u003ereconnect delayed work in\nclean_demultiplex_info() before the server is freed, the same way\ncifs_put_tcp_session() already does."
          }
        ],
        "id": "CVE-2026-98175",
        "lastModified": "2026-10-07T07:17:04.003",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:17:59.477",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-08T12:02:18+00:00",
      "cve": "CVE-2026-98175",
      "id": "CVE-2026-98175",
      "initial_release_date": "2026-10-06T00:00:00+00:00",
      "product_status:known_affected": "235",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: cancel reconnect work in clean_demultiplex_info()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98175.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-07T00:01:02Z",
      "cve": "CVE-2026-98175",
      "id": "CVE-2026-98175",
      "initial_release_date": "2026-10-07T00:01:02Z",
      "product_status:known_affected": "343",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98175",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98175.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.