Linux Kernel
CVE-2024-35869
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Client-side UAF requires initiating a DFS mount toward a malicious server (UI:R, AC:H for the race/referral condition); memory corruption yields integrity and availability impact, no direct confidentiality read.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: guarantee refcounted children from parent session
Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at it, too.
AnalysisAI
Use-after-free memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) affects the DFS (Distributed File System) referral-walking, mounting, and failover code paths in kernel 6.9 release candidates. The flaw stems from child tree-connection sessions derived from a parent SMB session not being properly reference-counted, so they can be freed while still in use during a DFS mount. No public exploit has been identified at time of analysis, EPSS estimates only a 0.25% exploitation probability, and the issue is not listed in CISA KEV.
Technical ContextAI
The affected component is the in-kernel SMB3/CIFS client used for mounting Microsoft SMB network shares on Linux. Specifically, the DFS subsystem walks referrals to locate the correct target server for a namespace path and performs failover when a target is unavailable. Each mount establishes a hierarchy of objects - a session (@ses), tree connections (@tcon), and DFS child sessions - that must remain valid for the lifetime of the mount. The root cause is CWE-416 (Use After Free): children derived from the parent @tcon->ses were not all reference-counted, so an object could be released while another code path still held and dereferenced a pointer to it. The fix guarantees refcounted children from the parent session and removes the now-redundant @tcon->dfs_ses_list list. The affected CPEs identify Linux kernel 6.9-rc1 and 6.9-rc2 pre-release builds.
RemediationAI
Upgrade to a Linux kernel that includes the fix - patch available per vendor: the corrective commits are 062a7f0ff46eb57aff526897bd2bebfdb1d3046a, 645f332c6b63499cc76197f9b6bffcc659ba64cc, and e1db9ae87b7148c021daee1fcc4bc71b2ac58a79 on git.kernel.org/stable, incorporated into the corresponding stable point releases; consume the fixed kernel from your distribution's update stream rather than building an rc kernel. As a compensating control where patching is deferred, avoid mounting untrusted or attacker-controlled SMB/DFS shares and restrict which SMB servers clients are permitted to connect to (egress-filter SMB/CIFS ports 445/139 to trusted file servers only), since exploitation requires the client to walk a DFS referral from a potentially malicious server; the trade-off is loss of connectivity to any legitimately reachable but non-allowlisted SMB target. If DFS namespaces are not required, mounting shares by direct target UNC path rather than via DFS namespaces avoids the vulnerable referral-walking code, at the cost of losing DFS failover and namespace abstraction.
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today