All vulnerabilities
CVE-2026-98175

Linux: smb: client: cancel reconnect work in clean_demultiplex_info()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in180380272f116dbd2b0354c5c7872e112e519149Also 7ab9ceedd860216fb97f2d8574cbe58b8906f42a, 2e5103e11a17c274715dd56cf185eeedccf686b8 and 8 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

Show all 11 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: cancel reconnect work in clean_demultiplex_info()

clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued:

cifs_demultiplex_thread() cifs_readv_from_socket() cifs_reconnect() __cifs_reconnect() cifs_queue_server_reconn() mod_delayed_work(cifsiod_wq, &server->reconnect, 0) clean_demultiplex_info() cancel_delayed_work_sync(&server->echo) // echo canceled // reconnect NOT canceled kfree_sensitive(server) // server freed

...later, on cifsiod_wq:

smb2_reconnect_server() server->srv_count // UAF read of freed server

Fix this by canceling server->reconnect delayed work in clean_demultiplex_info() before the server is freed, the same way cifs_put_tcp_session() already does.

Text from CVE List

Affected versions 28

  • Linuxaffected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before 180380272f116dbd2b0354c5c7872e112e519149CVE List
  • Linuxaffected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before e3f6a779433d13aafb5edab59e4f9313051e8a52CVE List
  • Linuxaffected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before 7ab9ceedd860216fb97f2d8574cbe58b8906f42aCVE List
  • Linuxaffected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before 2e5103e11a17c274715dd56cf185eeedccf686b8CVE List
  • Linuxaffected: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before c65eae6f61d1778ff7a82e4aae4080e26f486af1CVE List
  • Linuxaffected: e008a962311a875a828cbae54b43285858aaa6c8CVE List
  • Linuxaffected: 123b228a09b90b50b0a9d6eb8294cf0c42efc029CVE List
  • Linuxaffected: 0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9CVE List
  • Linuxaffected: d0d2a4c82942e2f51e4984beea1f7e5a994bd06cCVE List
  • Linuxaffected: 15a12fbbf365a483b1c19f9caeb707b3bea77e10CVE List
  • Linuxaffected: f0b715409cb9cf7e21e690f9b163047739761962CVE List
  • Linuxaffected: ff04da387c10b6bf7b510392742c8cd46c130fd6CVE List
  • Linuxaffected: 48f9526f4dcb4b132fe0dc2450835311e3b013a6CVE List
  • Linuxaffected: 3.10.107 before 3.11CVE List
  • Linuxaffected: 3.12.70 before 3.13CVE List
  • Linuxaffected: 3.16.42 before 3.17CVE List
  • Linuxaffected: 3.18.47 before 3.19CVE List
  • Linuxaffected: 4.1.38 before 4.2CVE List
  • Linuxaffected: 4.4.40 before 4.5CVE List
  • Linuxaffected: 4.8.16 before 4.9CVE List
  • Linuxaffected: 4.9.1 before 4.10CVE List
  • Linuxaffected: 4.10CVE List
  • Linuxunaffected: all versions before 4.10CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5