CVE-2026-97562
Received Received - Intake

smb: client DFS superblock use-after-free vulnerability

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97562
EUVD
EUVD-2026-86870

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition vulnerability in the Linux kernel's SMB client implementation. It occurs when the superblock pointer is stored without proper reference counting. The issue arises because tcon_super_cb() saves a raw superblock pointer while __cifs_get_super() only takes an active reference after iterate_supers_type() has released its passive reference. This allows concurrent DFS automount expiry to free the superblock before cifs_sb_active() can use it, leading to a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and may not have direct detection commands. However, you can check your kernel version and look for related errors in system logs. Use 'uname -r' to check the kernel version and 'dmesg | grep -i cifs' to search for CIFS-related errors.

Impact Analysis

This vulnerability could cause system instability or crashes due to kernel memory corruption. An attacker might exploit this to trigger a kernel panic or execute arbitrary code with kernel privileges. Systems using SMB client functionality with DFS automount are particularly affected.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the vulnerability is patched. If immediate patching is not possible, consider disabling SMB client features or restricting network access to SMB shares until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart