What is the CVSS score of CVE-2024-35865?

CVE-2024-35865 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2024-35865?

A use-after-free vulnerability in the Linux kernel's in-kernel SMB client could allow a compromised or attacker-positioned file server to trigger kernel memory corruption on connecting systems.. A patch is available.

How to fix or mitigate CVE-2024-35865?

Within 24 hours, audit all Linux systems using the kernel SMB client (cifs.ko) and catalog their SMB server dependencies, including containerized and cloud workloads. Within 7 days, test the vendor-released kernel patch in a staging environment that mirrors production SMB connectivity profiles, coordinating with storage and infrastructure teams. Within 30 days, deploy the patched kernel across production systems in phased batches, prioritizing those connecting to external or less-trusted SMB servers, and validate patch application through kernel version verification.

Linux Kernel CVE-2024-35865

CRITICAL

Use After Free (CWE-416)

2024-05-19 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Use After Free Memory Corruption

9.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Remote but requires connecting to a malicious SMB server (UI:R) and winning a teardown race (AC:H); UAF most reliably yields DoS (A:H) with limited memory disclosure/corruption (C:L/I:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 11:37 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM CRITICAL

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 9.8 (CRITICAL)

CVE Published

May 19, 2024 - 09:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_is_valid_oplock_break()

Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

AnalysisAI

Use-after-free in the Linux kernel's in-kernel SMB client (cifs.ko) affects the smb2_is_valid_oplock_break() handler, where sessions being torn down (SES_EXITING) were not skipped, allowing a freed session structure to be dereferenced while processing an SMB2 oplock break notification. A malicious or compromised SMB/CIFS server (or a man-in-the-middle) can trigger the race against a connecting Linux client, potentially causing kernel memory corruption. EPSS is very low (0.02%) and there is no public exploit identified at time of analysis, so despite the NVD CVSS of 9.8 the realistic risk is memory-safety-race-dependent rather than trivially weaponizable.

Technical ContextAI

The affected component is the Linux kernel SMB2/SMB3 network filesystem client (fs/smb/client, formerly fs/cifs). When an SMB server sends an oplock/lease break notification, the client walks its list of active sessions (tcp_ses_list / smb_ses) to match the break to an open file. The root cause is CWE-416 (Use After Free): the iteration did not exclude sessions in the SES_EXITING state, so a session whose reference was being released during teardown could be accessed after free, corrupting kernel heap memory. CPE data scopes this to linux:linux_kernel including the 6.9-rc1 and 6.9-rc2 development builds, with the fix backported to multiple stable branches (four stable commits are referenced). The fix adds a status check to skip sessions marked SES_EXITING before dereferencing them.

RemediationAI

Upstream fix available (stable commits, not a single tagged upstream release number in the input): apply the patched kernel from the referenced kernel.org stable commits 21fed37d2bdc, 22863485a462, 3dba0e5276f1, or 84488466b7a6 (https://git.kernel.org/stable/c/84488466b7a69570bdbf76dd9576847ab97d54e7), or install your distribution's fixed package - Ubuntu users should update per USN-8575-1 (https://ubuntu.com/security/notices/USN-8575-1). Where immediate patching is not possible, the practical compensating control is to avoid mounting SMB/CIFS shares from untrusted or attacker-reachable servers and to restrict outbound SMB (TCP 445) to known-good file servers, since the bug is only reachable through the SMB client path; the trade-off is loss of SMB connectivity to unvetted hosts. If the cifs module is not needed, blacklisting/unloading the cifs kernel module eliminates the attack surface entirely, at the cost of removing SMB mount capability.