CVE-2026-74608
Received Received - Intake

Use-After-Free in Linux Kernel SMB Client

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory. Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74608
EUVD
EUVD-2026-64545

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's SMB client implementation. It occurs in the cifs_try_adding_channels() function when handling channel creation for SMB connections. The issue arises when a temporary reference to an interface is dropped but then accessed after being freed due to a race condition during concurrent interface list refreshes.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS/SMB client implementation. Detection requires checking kernel logs for crashes or memory corruption related to cifs_try_adding_channels() or interface list refreshes. Monitor for kernel oops messages or system hangs during SMB operations.

Impact Analysis

This vulnerability could lead to system crashes or potential privilege escalation if exploited. It specifically affects systems using the Linux kernel's CIFS/SMB client functionality, potentially disrupting network file sharing operations and causing instability in affected systems.

Mitigation Strategies

Update your Linux kernel to the patched version that resolves this issue. Avoid using SMB multi-channel features until patched. Monitor kernel logs for any signs of exploitation or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart