Use-after-free memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) affects the DFS (Distributed File System) referral-walking, mounting, and failover code paths in kernel 6.9 release candidates. The flaw stems from child tree-connection sessions derived from a parent SMB session not being properly reference-counted, so they can be freed while still in use during a DFS mount. No public exploit has been identified at time of analysis, EPSS estimates only a 0.25% exploitation probability, and the issue is not listed in CISA KEV.
Use-after-free memory corruption in the Linux kernel's SMB/CIFS client (cifs module) is triggered when the smb2_reconnect_server() worker accesses an SMB session that is concurrently being torn down by __cifs_put_smb_ses(), producing a kernel general-protection fault (poison pointer 0x6b6b...). It affects the CIFS client in kernel 6.9 release candidates and was resolved upstream by unconditionally setting the session status to SES_EXITING to close the race window. No public exploit identified at time of analysis, EPSS is low (0.23%), and it is not on CISA KEV; realistic impact is a kernel crash on hosts that actively mount SMB shares against a server that drops and re-establishes connections.
Use-after-free in the Linux kernel's in-kernel SMB client (cifs.ko) affects the smb2_is_valid_oplock_break() handler, where sessions being torn down (SES_EXITING) were not skipped, allowing a freed session structure to be dereferenced while processing an SMB2 oplock break notification. A malicious or compromised SMB/CIFS server (or a man-in-the-middle) can trigger the race against a connecting Linux client, potentially causing kernel memory corruption. EPSS is very low (0.02%) and there is no public exploit identified at time of analysis, so despite the NVD CVSS of 9.8 the realistic risk is memory-safety-race-dependent rather than trivially weaponizable.
Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_data_received_cb, and Service.remove. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.