smb: client: Fix use-after-free in cifs_try_adding_channels()
Summary
| CVE | CVE-2026-74608 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-22 16:16:33 UTC |
| Updated | 2026-08-22 16:16:33 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory. Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access. |
Risk And Classification
EPSS: 0.001730000 probability, percentile 0.067150000 (date 2026-08-24)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected cbc53148cc0946b72d62a3c53870cb22ce4ec284 64d7584e62ac8cdc750455c5fdc6008fc2de4f06 git | Not specified |
| CNA | Linux | Linux | affected cff97d683a083b862a8bb24309e0f4d2d928128a c292d4686f717c03e5022fc4ae7c782f39a94915 git | Not specified |
| CNA | Linux | Linux | affected 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 47dfac48bce7198ad4f1a388fc8c9491f878ac3b git | Not specified |
| CNA | Linux | Linux | affected 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 1ffacbadc14530e55b8d86f7b917524f6a0fb891 git | Not specified |
| CNA | Linux | Linux | affected 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805 git | Not specified |
| CNA | Linux | Linux | affected 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 4986410316b1ae0e63c6ce418e4eb196723626e7 git | Not specified |
| CNA | Linux | Linux | affected 22a6c5b3425f327e7f4c3606a72277dce82c7d83 git | Not specified |
| CNA | Linux | Linux | affected 6.1.78 6.1.183 semver | Not specified |
| CNA | Linux | Linux | affected 6.6.17 6.6.152 semver | Not specified |
| CNA | Linux | Linux | affected 6.7.5 6.8 semver | Not specified |
| CNA | Linux | Linux | affected 6.8 | Not specified |
| CNA | Linux | Linux | unaffected 6.8 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.183 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.152 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.104 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.45 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.9 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.