CVE-2026-98173

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels() cifs_try_adding_channels() iterates ses->iface_list with list_for_each_entry_safe_from(), which captures the next entry (niface) under iface_lock. The loop body then drops iface_lock for the whole duration of cifs_ses_add_channel(). A concurrent interface refresh (SMB3_request_interfaces() -> parse_server_interfaces()) marks all ifaces inactive and removes and frees any that are not re-advertised via list_del() + kref_put(), where release_iface() is a bare kfree(). Since niface typically has no channel holding a reference, the list reference is its last and it can be freed inside the unlocked window. On continue, the iterator advance step then dereferences niface->iface_head.next, and the loop body reads iface->rdma_capable/is_active, both on freed memory. Fix this by never keeping an unreferenced list pointer across the unlocked window. Each channel attempt now re-scans the list from the head under iface_lock, takes a kref on the selected candidate, and passes only that referenced candidate to cifs_ses_add_channel(). weight_fulfilled still tracks selection progress, so restarting the scan preserves the original weighted distribution and the weight_fulfilled-before-kref_put ordering on the failure path. Add a per-pass attempts cap so a flapping interface refresh cannot keep the inner loop spinning within a single tries increment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98173

EUVD

EUVD-2026-93101

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	aa45dadd34e44fcd6a9df4b395bee5b5633b4cec
Linux	Linux	aa45dadd34e44fcd6a9df4b395bee5b5633b4cec
Linux	Linux	aa45dadd34e44fcd6a9df4b395bee5b5633b4cec
Linux	Linux	aa45dadd34e44fcd6a9df4b395bee5b5633b4cec
Linux	Linux	5.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's SMB client implementation. It occurs in the cifs_try_adding_channels() function where a list iterator captures a pointer to a network interface while holding a lock, but then drops the lock before using the pointer. A concurrent operation can free the interface, leading to memory corruption when the iterator later dereferences the freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS/SMB client implementation. Detection requires checking kernel versions and CIFS module behavior. Use commands like 'uname -a' to check kernel version and 'lsmod | grep cifs' to verify CIFS module loading. Monitor system logs for SMB connection errors or crashes during interface refreshes.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or potentially allow privilege escalation if exploited. Systems using SMB client functionality with multiple network interfaces are most at risk. The impact depends on whether an attacker can trigger the race condition.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's SMB client, specifically in the CIFS subsystem. It does not directly relate to data protection, encryption, or access control mechanisms that GDPR or HIPAA typically address. Compliance impact would depend on whether the affected system processes sensitive data, but the vulnerability itself is not a direct violation of these standards.

Mitigation Strategies

Apply the latest Linux kernel security updates immediately. If updating is not possible, disable the CIFS/SMB client module temporarily with 'modprobe -r cifs' or restrict SMB connections via firewall rules. Monitor vendor advisories for patches addressing this use-after-free issue.

Hi! I’m here to help you understand CVE-2026-98173. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70