EUVD-2026-76549
GHSA-q27p-5553-xhrr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable only via attacker/MITM server the victim chooses to mount (UI:R) and a demux-thread race (AC:H); UAF primarily crashes/corrupts memory (A:H, limited C/I).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free.
Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.
AnalysisAI
A use-after-free and memory leak in the Linux kernel's CIFS/SMB client (cifs_check_trans2 in the SMB1 TRANSACT2 reassembly path) can be triggered when a malicious or man-in-the-middle SMB server sends a malformed secondary TRANSACT2 response after a valid primary one. Because handle_mid() overwrites mid->resp_buf and skips clearing the server's smallbuf/bigbuf pointers when multiRsp is set, the demux thread later reuses a freed buffer, corrupting kernel memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim Linux host to mount a CIFS/SMB1 (vers=1.0) share from a server the attacker controls or can man-in-the-middle, and the attacker must send a malformed secondary TRANSACT2 response after a valid primary TRANSACT2 response so cifs_check_trans2() returns false (invalid SMB header or check2ndT2() rejection) while mid->multiRsp is already set. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) overstates real-world risk and is inconsistent with the mechanism. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.51, 7.2.4, or 7.3-rc1, or backport the stable-tree commits (9eed72e9534b, 5e6533a683f6, 730d0bb19507) which combine the two early-exit conditions in cifs_check_trans2() and abort the pending transaction inline (set multiEnd, call dequeue_mid() with malformed=true, return true) so handle_mid() never overwrites mid->resp_buf or the server buffer pointers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems running kernel versions prior to 6.18.51, 7.2.4, or 7.3-rc1 that actively mount CIFS/SMB shares, particularly from external or untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today