CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: clear ce->tgthint in freetgts()
When freetgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cachedfstgt structures.
If ce->tgthint is not reset before it is used later, it results in a use-after-free.
Set ce->tgthint to NULL in freetgts() after the elements are freed to reflect that no elements remain.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In free_tgts(), set ce->tgthint to NULL after free_tgts() frees all structures in ce->tlist, so ce->tgthint does not point to a freed cache_dfs_tgt element.
Linux kernel SMB client ce->tgthint = NULL
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel SMB client are potentially exposed when the affected DFS target-cache cleanup path is exercised. The issue is in client-side SMB handling, not described as affecting SMB servers.
What condition triggers the use-after-free?
The condition occurs after free_tgts() frees the entries in ce->tlist but leaves ce->tgthint pointing to a freed cache_dfs_tgt structure. A later use of that stale hint can dereference freed memory.
How is the issue fixed?
The fix resets ce->tgthint to NULL after free_tgts() releases the target-list entries. This ensures the hint reflects that no cached target structures remain.