EUVD-2026-64545
GHSA-q727-xf93-53j5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Locally reachable only via CIFS multichannel setup (PR:L to mount/use), win a narrow concurrency race (AC:H); kernel slab UAF yields high C/I/A within the unchanged scope.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix use-after-free in cifs_try_adding_channels()
cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled.
A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.
Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.
AnalysisAI
Use-after-free in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) lets a race between SMB multichannel channel setup and an interface-list refresh free an 'iface' object that is then written to via weight_fulfilled, corrupting freed kernel memory. It affects systems that mount SMB shares with multichannel across many stable branches (6.1.x through 6.18.x and 7.x, fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the CIFS client with SMB multichannel active - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and should be reconciled before prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host that mounts an SMB share with multichannel enabled, an attacker (or a malicious/compromised SMB server that advertises and then rapidly changes its network interfaces) forces repeated channel-addition attempts to fail while triggering a concurrent interface-list refresh. Winning the narrow race frees the iface object just before weight_fulfilled is updated, corrupting kernel slab memory and typically crashing the host, with a theoretical path to privilege escalation. … |
| Remediation | Upgrade to a fixed stable kernel for your branch - Vendor-released patch: 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2 (pick the fixed release matching your series), or apply your distribution's backport of the corresponding kernel.org stable commits (https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running affected kernel versions (6.1.x through 6.18.x and 7.x) that mount SMB shares. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today