CVE-2026-97562smb: client: pin DFS superblock in iterator callback
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bacd704a95ad0b93af995aae4a523aa046f46563 before 3c9acc9835c304013a4faeb969fe9333d66ca9f8; from bacd704a95ad0b93af995aae4a523aa046f46563 before ea43a15cea36dc5ddd832be5bddeac7dd804cbcf; from bacd704a95ad0b93af995aae4a523aa046f46563 before a6b6561522212af852c9ad8a7dca8d59ef2c7377; from bacd704a95ad0b93af995aae4a523aa046f46563 before 5b01a8c0209690db75341528ec53fd87e0ac1460; from bacd704a95ad0b93af995aae4a523aa046f46563 before d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818 | CNA record |
References
- https://git.kernel.org/stable/c/3c9acc9835c304013a4faeb969fe9333d66ca9f8
- https://git.kernel.org/stable/c/ea43a15cea36dc5ddd832be5bddeac7dd804cbcf
- https://git.kernel.org/stable/c/a6b6561522212af852c9ad8a7dca8d59ef2c7377
- https://git.kernel.org/stable/c/5b01a8c0209690db75341528ec53fd87e0ac1460
- https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.