Linux Kernel EUVD-2026-27777

Exploitation requires user interaction to initiate a CIFS mount operation to an attacker-controlled SMB server. The victim must either manually mount a malicious share (via mount.cifs command or file manager SMB browsing) or have auto-mount configurations pointing to attacker-influenced paths. The Linux system must have the CIFS kernel module loaded (CONFIG_CIFS=y or CONFIG_CIFS=m with module loaded). Successful exploitation depends on winning race conditions in concurrent CIFS operations, requiring the attacker to send precisely timed malformed SMB protocol responses during tcon field access windows - this makes exploitation non-deterministic and likely requiring multiple connection attempts. Attack is limited by the UI:R requirement: passive network attacks against existing mounts are insufficient; active user participation in establishing connections to malicious servers is required. Systems not using CIFS mounts or those with firewall rules blocking SMB to untrusted networks are not exploitable via this vector.

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) appears internally inconsistent and warrants critical scrutiny. The vector indicates network-accessible (AV:N), no privileges required (PR:N), yet requires user interaction (UI:R) - an unusual combination for a kernel race condition that typically exploits timing windows independent of user action. This suggests either misclassification or a specific attack scenario where a user must mount a malicious CIFS share. The EPSS score of 0.02% (5th percentile) indicates extremely low real-world exploitation likelihood, likely because exploitation requires precise timing manipulation in kernel code paths and user-triggered SMB operations. No CISA KEV listing confirms no evidence of active exploitation. The 'Information Disclosure' tag suggests the primary risk may be information leakage from race conditions rather than the full CIA triad impact claimed by CVSS 8.8. Real priority assessment: MEDIUM - patch during regular maintenance cycles for systems using CIFS mounts, prioritize only for environments with untrusted SMB servers where users regularly connect to external shares. The UI:R requirement significantly limits attack surface compared to typical kernel vulnerabilities. Verification needed: Confirm whether attack requires user to mount attacker-controlled share versus exploiting existing mounts.

An attacker operates a malicious SMB file server and uses social engineering to convince a target user to mount a CIFS share from the attacker's server (e.g., via phishing link containing smb:// URL or instructions to mount \\attacker.com\share). When the victim's Linux system establishes the CIFS connection and the user performs file operations, the attacker sends carefully timed malformed SMB responses designed to trigger race conditions in the kernel's tcon field access. By exploiting the synchronization gap between cifs_tcp_ses_lock and tc_lock usage, the attacker manipulates tree connection state during concurrent operations, potentially reading kernel memory (information disclosure), corrupting connection state (integrity impact), or causing kernel panic (availability impact). No public exploit code exists at time of analysis, but kernel race conditions are well-understood exploitation primitives once timing constraints are characterized.