EUVD-2026-76553
GHSA-f4f3-66v7-cmrj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between SMB session teardown and RPC failure warrants AC:H over the NVD-assigned AC:L; AV:L and PR:L reflect required local file access on a CIFS mount.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
When the else branch of cifs_file_set_size() finds a writable file handle via find_writable_file(), it borrows tcon and server from the handle's tlink, attempts the handle-based set_file_size() RPC, and then releases the handle with cifsFileInfo_put().
If set_file_size() fails, execution falls through to the path-based fallback, which reuses the borrowed tcon and server under the "if (tcon == NULL)" guard. Since tcon is not NULL at that point, the guard is skipped. If cifsFileInfo_put() dropped the last reference on a tlink that was already removed from the tlink tree (TCON_LINK_IN_TREE cleared, as happens during reconnection or session teardown), cifs_put_tlink() will have freed tcon; the subsequent set_path_size() call is then a use-after-free.
Setting tcon = NULL after cifsFileInfo_put() causes the existing guard to take the cifs_sb_tlink() path, which acquires a fresh reference for the path-based operation or fails cleanly if the session is gone.
AnalysisAI
Use-after-free in the Linux kernel CIFS client's cifs_file_set_size() allows a local low-privileged user to corrupt kernel heap memory when a handle-based set-size RPC fails during SMB session teardown or reconnection. The freed tcon pointer is reused in a path-based fallback because it is not NULLed after cifsFileInfo_put(), exposing slab memory that may have been reclaimed by the kernel allocator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following conditions must hold simultaneously: (1) the target system must have a CIFS/SMB network filesystem actively mounted with the cifs kernel module loaded; (2) the attacker must have local, low-privileged access sufficient to open and resize files on that mount (PR:L); (3) a handle-based set_file_size() RPC must fail - typically requiring a network error or server-side rejection at the precise moment of the call; (4) the tlink's TCON_LINK_IN_TREE flag must have been cleared at the time cifsFileInfo_put() runs, a transient state that occurs only during SMB session teardown or reconnection, making this a race condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L) likely overstates exploitability: AC:L does not capture the inherent race condition between SMB session teardown and a failing handle RPC, which is timing-dependent and more accurately represented by AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 6.18.50, 7.2.4, or 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit Linux infrastructure to identify systems running kernel versions before 6.18.50, 7.2.4, or 7.3-rc1, particularly those with CIFS/SMB mounts or multi-user access patterns; document affected systems and prioritize by criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today