EUVD-2026-76548
GHSA-4452-h45j-w5mp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote malicious/MITM SMB server (AV:N, PR:N) but needs DFS in use (UI:R) and a cache-lifecycle race (AC:H); outcome is primarily a kernel crash (A:H) with limited info exposure (C:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: clear ce->tgthint in free_tgts()
When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures.
If ce->tgthint is not reset before it is used later, it results in a use-after-free.
Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.
AnalysisAI
Use-after-free in the Linux kernel's SMB/CIFS client DFS referral cache lets a dangling target-hint pointer be dereferenced after the backing structures are freed. In free_tgts(), all cache_dfs_tgt entries on ce->tlist are freed but ce->tgthint is left pointing at one of them, so a subsequent lookup of the preferred DFS target reads freed slab memory (CWE-416). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the host to be actively using the in-kernel SMB/CIFS client to access DFS (Distributed File System) referral-based shares - the vulnerable free_tgts()/ce->tgthint path only exists in the DFS cache layer, so non-DFS SMB mounts and hosts not using CIFS at all are unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 6.12.109, 6.18.50, or 7.2.4 (or 7.3-rc1 / later mainline), which set ce->tgthint = NULL in free_tgts(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems using SMB/CIFS with DFS shares enabled by checking mount configurations and cifs kernel module parameters; prioritize systems exposed to external or untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today