CVE-2026-74608
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
smb: client: Fix use-after-free in cifs_try_adding_channels()
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory. Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| cbc53148cc0946b72d62a3c53870cb22ce4ec284 | affected | git | 64d7584e62ac8cdc750455c5fdc6008fc2de4f06 | Unavailable | None listed |
| cff97d683a083b862a8bb24309e0f4d2d928128a | affected | git | c292d4686f717c03e5022fc4ae7c782f39a94915 | Unavailable | None listed |
| 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 | affected | git | 47dfac48bce7198ad4f1a388fc8c9491f878ac3b | Unavailable | None listed |
| 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 | affected | git | 1ffacbadc14530e55b8d86f7b917524f6a0fb891 | Unavailable | None listed |
| 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 | affected | git | 1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805 | Unavailable | None listed |
| 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 | affected | git | 4986410316b1ae0e63c6ce418e4eb196723626e7 | Unavailable | None listed |
| 22a6c5b3425f327e7f4c3606a72277dce82c7d83 | affected | git | Unavailable | Unavailable | None listed |
| 6.1.78 | affected | semver | 6.1.183 | Unavailable | None listed |
| 6.6.17 | affected | semver | 6.6.152 | Unavailable | None listed |
| 6.7.5 | affected | semver | 6.8 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.8 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.8 | Unavailable | None listed |
| 6.1.183 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.152 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.104 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.45 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.1.9 | unaffected | semver | Unavailable | 7.1.* | None listed |
| 7.2 | unaffected | original_commit_for_fix | Unavailable | * | None listed |