Linux Kernel EUVD-2026-76549

Requires the victim Linux host to mount a CIFS/SMB1 (vers=1.0) share from a server the attacker controls or can man-in-the-middle, and the attacker must send a malformed secondary TRANSACT2 response after a valid primary TRANSACT2 response so cifs_check_trans2() returns false (invalid SMB header or check2ndT2() rejection) while mid->multiRsp is already set. Exploitation is further gated by a race in the kernel demux thread that must reuse the freed server->smallbuf/bigbuf, and by the client actually using the SMB1 multi-response TRANSACT2 path - modern SMB2/SMB3-only mounts do not reach this code. These factors (attacker-controlled/MITM server prerequisite plus a timing race) limit realistic exploitation despite the network attack vector.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) overstates real-world risk and is inconsistent with the mechanism. Exploitation is not against a listening service: the victim host must actively mount an SMB share from a server the attacker controls or can MITM, and the bug additionally depends on a race between the user thread freeing the buffer and the demux thread reusing it - that is genuinely AC:H, not AC:L. The primary observable impact is a kernel use-after-free, which is far more likely to yield a crash/DoS or memory corruption than reliable confidentiality loss, so C:H/I:H/A:H is optimistic. Corroborating signals point the same way: EPSS is 0.20% (10th percentile), the CVE is not in CISA KEV, and no proof-of-concept is referenced. The 'Information Disclosure' tag understates the issue - a UAF is memory-corruption, not merely an info leak. Net: a legitimate bug worth patching on affected kernels, but a lower operational priority than the 9.8 headline suggests, and not indicative of widespread or automatable exploitation.

An attacker operates a malicious SMB server (or MITMs a cleartext SMB1 connection) and waits for a Linux client to mount a share over the CIFS/SMB1 protocol. When the client issues a TRANSACT2 request, the server returns a valid primary response followed by a malformed secondary TRANSACT2 PDU, driving cifs_check_trans2() to fail and leaving a dangling server buffer that the demux thread reuses, corrupting kernel memory and typically crashing the host. No public exploit is identified at time of analysis, and success depends on winning the demux-thread timing window.