CVE-2026-97562
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
smb: client: pin DFS superblock in iterator callback
In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| bacd704a95ad0b93af995aae4a523aa046f46563 | affected | git | 3c9acc9835c304013a4faeb969fe9333d66ca9f8 | Unavailable | None listed |
| bacd704a95ad0b93af995aae4a523aa046f46563 | affected | git | ea43a15cea36dc5ddd832be5bddeac7dd804cbcf | Unavailable | None listed |
| bacd704a95ad0b93af995aae4a523aa046f46563 | affected | git | a6b6561522212af852c9ad8a7dca8d59ef2c7377 | Unavailable | None listed |
| bacd704a95ad0b93af995aae4a523aa046f46563 | affected | git | 5b01a8c0209690db75341528ec53fd87e0ac1460 | Unavailable | None listed |
| bacd704a95ad0b93af995aae4a523aa046f46563 | affected | git | d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.7 | Unavailable | None listed |
| 6.6.158 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.111 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.53 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.7 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |