CVE-2026-89636smb: client: clear ce->tgthint in free_tgts()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 54be1f6c1c37498bba557049df646cc239fa37e3 builds before 14f60e959b5ac813715ff72e127beb3584ddabf6; 54be1f6c1c37498bba557049df646cc239fa37e3 builds before 3ff9462bb7a06d8d32a1dc02d39580b078ec9e55; from 54be1f6c1c37498bba557049df646cc239fa37e3 before 7507bd1885643d0461a6017767492450af1ce2a3; 54be1f6c1c37498bba557049df646cc239fa37e3 builds before 9ab46a13798a61d9d020b01d4e57efdabe6624fa; 54be1f6c1c37498bba557049df646cc239fa37e3 builds before 5baab40404a9393bcc0b7b8f1950bf2c307e0984; from 54be1f6c1c37498bba557049df646cc239fa37e3 before b1b741cf8e7ce1b91d937e23decd3d3358748700 | CNA record |
References
- https://git.kernel.org/stable/c/14f60e959b5ac813715ff72e127beb3584ddabf6
- https://git.kernel.org/stable/c/3ff9462bb7a06d8d32a1dc02d39580b078ec9e55
- https://git.kernel.org/stable/c/7507bd1885643d0461a6017767492450af1ce2a3
- https://git.kernel.org/stable/c/9ab46a13798a61d9d020b01d4e57efdabe6624fa
- https://git.kernel.org/stable/c/5baab40404a9393bcc0b7b8f1950bf2c307e0984
- https://git.kernel.org/stable/c/b1b741cf8e7ce1b91d937e23decd3d3358748700
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.