CVE-2026-98261: cifs: Fix server use-after-free in cifs_chan_skip_or_disable()

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 6.6.158.1-1
2. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 6.6.158
3. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 6.12.112
4. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 6.18.54
5. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 7.2.8
6. Upgrade

   Upgrade debian/linux to a version that resolves this vulnerability.

   Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
7. Upgrade

   Upgrade debian/linux-6.12 to a version that resolves this vulnerability.

   Fixed in 6.12.113-1~deb12u1
8. Upgrade

   Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.

   Fixed in 7.0.0-42.42~24.04.1
9. Upgrade

   Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.

   Fixed in 7.0.0-42.42.1~24.04.1
10. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 7.0.0-42.42
11. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.17
12. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.18
13. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17
14. Upgrade

    Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17
15. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 7.0.0-1015.16
16. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 7.0.0-42.42.1
17. Compensating control

    In cifs_chan_skip_or_disable(), signal the channel and primary server and capture the primary_server pointer before dropping the channel reference with cifs_put_tcp_session(), so the channel and primary server are not used after they may have been freed.

Event History

Parent advisories

This vulnerability appears in the following advisories.

• DSA-6568

Peer vulnerabilities

Found alongside the following vulnerabilities.

• DLA-4850-1

Frequently Asked Questions