UBUNTU-CVE-2026-98173: Use After Free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels() cifstryaddingchannels() iterates ses->ifacelist with listforeachentrysafefrom(), which captures the next entry (niface) under ifacelock. The loop body then drops ifacelock for the whole duration of cifssesaddchannel(). A concurrent interface refresh (SMB3requestinterfaces() -> parseserverinterfaces()) marks all ifaces inactive and removes and frees any that are not re-advertised via listdel() + krefput(), where releaseiface() is a bare kfree(). Since niface typically has no channel holding a reference, the list reference is its last and it can be freed inside the unlocked window. On continue, the iterator advance step then dereferences niface->ifacehead.next, and the loop body reads iface->rdmacapable/isactive, both on freed memory. Fix this by never keeping an unreferenced list pointer across the unlocked window. Each channel attempt now re-scans the list from the head under ifacelock, takes a kref on the selected candidate, and passes only that referenced candidate to cifssesaddchannel(). weightfulfilled still tracks selection progress, so restarting the scan preserves the original weighted distribution and the weightfulfilled-before-krefput ordering on the failure path. Add a per-pass attempts cap so a flapping interface refresh cannot keep the inner loop spinning within a single tries increment.