CVE-2026-97562: smb: client: pin DFS superblock in iterator callback
In the Linux kernel, the following vulnerability has been resolved:
smb: client: pin DFS superblock in iterator callback
tconsupercb() stores a raw superblock pointer, but cifsgetsuper() takes its active reference only after iteratesuperstype() has dropped sumount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifssbactive() uses it.
A deterministic KASAN test reproduces the race as:
BUG: KASAN: slab-use-after-free in cifssbactive+0x77/0x80
The same test passes with this change applied.
Take the active reference in the callback while iteratesuperstype() still holds sumount shared. cifsputtcpsuper() remains the matching release.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race?
Systems using the Linux kernel SMB/CIFS client with DFS automounts are relevant. The race requires DFS automount expiry to occur concurrently with superblock iteration and use of the returned superblock.
How can an affected system be identified?
A reproducing system may report a KASAN slab use-after-free in cifs_sb_active, such as "BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80". The issue was deterministically reproduced with a KASAN test.
What is the available remediation?
Apply a kernel update containing the referenced stable fixes. The correction takes the superblock active reference inside the iterator callback, before the iterator drops its protections, with cifs_put_tcp_super() retaining responsibility for releasing that reference.