CVE-2026-98175smb: client: cancel reconnect work in clean_demultiplex_info()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.33%, higher than 24% of scored CVEs.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in clean_demultiplex_info() clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued: cifs_demultiplex_thread() cifs_readv_from_socket() cifs_reconnect() __cifs_reconnect() cifs_queue_server_reconn() mod_delayed_work(cifsiod_wq, &server->reconnect, 0) clean_demultiplex_info() cancel_delayed_work_sync(&server->echo) // echo canceled // reconnect NOT canceled kfree_sensitive(server) // server freed ...later, on cifsiod_wq: smb2_reconnect_server() server->srv_count // UAF read of freed server Fix this by canceling server->reconnect delayed work in clean_demultiplex_info() before the server is freed, the same way cifs_put_tcp_session() already does.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.33% (percentile 24)
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before 180380272f116dbd2b0354c5c7872e112e519149; from 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before e3f6a779433d13aafb5edab59e4f9313051e8a52; 53e0e11efe9289535b060a51d4cf37c25e0d0f2b builds before 7ab9ceedd860216fb97f2d8574cbe58b8906f42a; 53e0e11efe9289535b060a51d4cf37c25e0d0f2b builds before 2e5103e11a17c274715dd56cf185eeedccf686b8; from 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before c65eae6f61d1778ff7a82e4aae4080e26f486af1; e008a962311a875a828cbae54b43285858aaa6c8; 123b228a09b90b50b0a9d6eb8294cf0c42efc029; 0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9; and 13 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149
- https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52
- https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a
- https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8
- https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.