CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix use-after-free in cifstryaddingchannels()
cifstryaddingchannels() takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel() fails, it drops that reference and then increments iface->weightfulfilled.
A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path krefput() releases the last reference and frees iface. Updating weightfulfilled afterward then accesses freed memory.
Increment weightfulfilled before dropping the temporary reference, keeping iface alive for the final access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems using the kernel SMB client are relevant. The affected path is reached while the client is trying to add SMB channels.
What conditions are required to trigger the use-after-free?
Channel creation must fail in cifs_ses_add_channel() while a concurrent interface-list refresh removes the interface list reference. The failure path can then release the final interface reference before weight_fulfilled is updated.
What does the fix change?
The fix increments the interface's weight_fulfilled value before dropping the temporary reference. This keeps the interface object alive through its final access on the channel-creation failure path.