All vulnerabilities
CVE-2026-97562

Linux: smb: client: pin DFS superblock in iterator callback

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3c9acc9835c304013a4faeb969fe9333d66ca9f8Also 5b01a8c0209690db75341528ec53fd87e0ac1460CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3c9acc9835c304013a4faeb969fe9333d66ca9f8LinuxCVE List
  • 5b01a8c0209690db75341528ec53fd87e0ac1460LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: pin DFS superblock in iterator callback

tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it.

A deterministic KASAN test reproduces the race as:

BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80

The same test passes with this change applied.

Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.

Text from CVE List

Affected versions 12

  • Linuxaffected: bacd704a95ad0b93af995aae4a523aa046f46563 before 3c9acc9835c304013a4faeb969fe9333d66ca9f8CVE List
  • Linuxaffected: bacd704a95ad0b93af995aae4a523aa046f46563 before ea43a15cea36dc5ddd832be5bddeac7dd804cbcfCVE List
  • Linuxaffected: bacd704a95ad0b93af995aae4a523aa046f46563 before a6b6561522212af852c9ad8a7dca8d59ef2c7377CVE List
  • Linuxaffected: bacd704a95ad0b93af995aae4a523aa046f46563 before 5b01a8c0209690db75341528ec53fd87e0ac1460CVE List
  • Linuxaffected: bacd704a95ad0b93af995aae4a523aa046f46563 before d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818CVE List
  • Linuxaffected: 5.7CVE List
  • Linuxunaffected: all versions before 5.7CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5