CVE-2026-93210: smb: client: harden DFS cache against invalid target hints
In the Linux kernel, the following vulnerability has been resolved:
smb: client: harden DFS cache against invalid target hints
Currently, gettgtname() returns ERRPTR(-ENOENT) when ce->tgthint is NULL, and dfscachenorequpdatetgthint() assumes ce->tgthint is always valid.
In preparation for clearing ce->tgthint in freetgts(), harden callers of gettgtname() against ERRPTR results and harden dfscachenorequpdatetgthint() against NULL pointer dereferences.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are affected?
The affected software is the Linux kernel SMB client, specifically its DFS cache handling. Systems that do not use the kernel SMB client are not indicated by the provided information as affected.
What is the failure mode?
A missing DFS target hint can cause get_tgt_name() to return an ERR_PTR(-ENOENT), while another DFS cache update path assumes the target hint is valid. This can result in a NULL pointer dereference.
How can I determine whether a kernel includes the fix?
Check whether the kernel source or vendor patch set includes the referenced stable commits a48328afbc3f63e3b9de8827e2e16c15b17976f7, 6cb7f9fed8f40f28fbd464ca99c946951afc0952, or 66dbcdbb0cadffd12eb8f2b115fd57d384c5109d.