Linux Kernel EUVD-2026-27800

Requires user to mount an SMB/CIFS share from or access SMB resources on an attacker-controlled server, satisfying CVSS UI:R (user interaction required). The target Linux system must have SMB client functionality enabled (CONFIG_CIFS kernel module loaded). Exploitation specifically targets the race window during SMB protocol negotiation when query_interface operations execute - this occurs during mount operations, network topology changes, or server multichannel negotiations. The attacker must control an SMB server that the victim connects to, limiting exploitation to scenarios where users mount untrusted SMB shares or where attackers can perform man-in-the-middle attacks on legitimate SMB traffic. Default Linux configurations with SMB client support are vulnerable, no non-default settings required. Limiting factors include the narrow race timing window (requires concurrent work queue execution), user interaction barrier (user must initiate SMB connection), and need for attacker-controlled or compromised SMB server infrastructure. Systems not using SMB client functionality or connecting only to trusted SMB servers face negligible practical risk despite network attack vector.

Despite the high CVSS base score of 8.8, real-world risk appears limited based on multiple converging signals. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network accessibility with low complexity, but critically requires user interaction - likely mounting an SMB share or accessing SMB resources. The EPSS score of 0.02% (5th percentile) suggests security researchers assess actual exploitation probability as extremely low. No CISA KEV listing exists, indicating no confirmed active exploitation. The vulnerability requires specific timing conditions where multiple query_interface operations execute concurrently, which typically occurs during SMB mount operations or network topology changes - not continuous attack surfaces. The high CIA impact ratings (H/H/H) represent worst-case race condition outcomes (memory corruption, information disclosure, denial of service), but achieving these reliably requires winning a narrow race window. Priority should be moderate: apply patches during normal maintenance cycles for systems using SMB client functionality, elevate urgency only for Linux systems heavily dependent on SMB/CIFS mounts in untrusted network environments. The availability of patches across all active stable kernel branches (6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0) reduces remediation friction significantly.

An attacker operates a malicious SMB server on a network accessible to the target Linux system. When a user mounts the attacker's SMB share or accesses SMB resources (satisfying the UI:R requirement), the malicious server responds with carefully timed interface negotiation responses designed to trigger concurrent query_interface work queue executions. By winning the race condition between multiple worker threads checking and updating iface_last_update, the attacker corrupts kernel memory structures managing SMB interface state. This could lead to information disclosure of kernel memory contents, modification of network interface configurations to redirect traffic, or kernel panic causing denial of service. No public proof-of-concept code identified at time of analysis, but the race window exploitation difficulty depends on system load and timing precision available to the attacker-controlled SMB server.