CVE-2026-98174: smb: client: fix rlist race and missing initialization
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix rlist race and missing initialization
TCPServerInfo.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making listempty() always return false and listadd() dereference a NULL ->prev pointer.
Also, cifssignalcifsdforreconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.
Affected Software
Event History
Frequently Asked Questions
Which deployments should prioritize this issue?
Linux systems using the kernel SMB client should be prioritized, because the affected code is in the SMB client’s reconnect-list handling. The provided data does not identify specific kernel versions or configurations.
What does an attacker need to exploit this vulnerability?
The CVSS vector indicates network reachability, no required privileges, and required user interaction. Exploitation is rated high complexity, so it is not described as a straightforward unauthenticated network attack.
What is the potential security impact?
The race and list initialization issue can corrupt the local reconnect list. The supplied CVSS assessment rates confidentiality, integrity, and availability impact as high.