Linux Kernel EUVD-2026-86870

Requires the host to have an active SMB/CIFS mount using DFS (Distributed File System) referrals so that DFS automounts and their expiry logic are in play. Exploitation depends on winning a narrow timing race between DFS automount expiry and a superblock lookup in __cifs_get_super()/cifs_sb_active(); it is a local kernel condition, not attacker-controllable input, and there is no evidence a remote party can steer it. Limiting factors: the CIFS client and DFS must be configured and mounted, the race window is small (high attack complexity), and the outcome is a crash rather than reliable code execution. Systems that do not mount DFS-enabled SMB shares are not affected.

This is a use-after-free (CWE-416) race condition in the Linux kernel's SMB/CIFS client DFS automount path, not a remotely triggerable memory-corruption primitive. The NVD CVSS of 7.5 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H substantially overstates real-world risk: the vulnerable code path (tcon_super_cb storing a raw superblock pointer while iterate_supers_type() has already dropped s_umount and its passive reference) is exercised by a concurrent DFS automount-expiry race on the client's own mount, an internal timing window that is not steered by a network attacker. AV:N and UI:R are dubious - reproduction was demonstrated deterministically via a local KASAN test, and the full C:H/I:H/A:H triad reads as reflexive worst-case scoring for any UAF rather than a demonstrated read/write/exec primitive. There is no EPSS score, no CISA KEV listing, and no public exploit; the only 'exploit' is a kernel-developer KASAN reproducer accompanying the fix. Realistically this is a crash/DoS-dominant local reliability bug, and its practical priority is low-to-moderate for systems that actually mount DFS SMB shares - well below what the 7.5 implies.

On a host with an active SMB/CIFS DFS mount, an automount expiry runs concurrently with a superblock lookup; iterate_supers_type() drops s_umount and the passive reference before __cifs_get_super() acquires its active reference, so the superblock is freed and cifs_sb_active() then dereferences freed slab memory. The result is a KASAN-detected slab-use-after-free and a likely kernel crash. No public exploit exists; the only proof is the developers' deterministic KASAN test used to validate the fix.