Linux Kernel EUVD-2026-93101

Requires the Linux CIFS/SMB client to have an active SMB3 session with multichannel in use (ses->iface_list populated and channels being added), connecting to an attacker-controlled or compromised SMB server. The attacker must drive a concurrent interface refresh (SMB3_request_interfaces -> parse_server_interfaces) that marks ifaces inactive and frees non-re-advertised entries precisely during the window where cifs_try_adding_channels() has dropped iface_lock for cifs_ses_add_channel(). Limiting factors: this is a timing-dependent race (CVSS AC:H) that typically must win a narrow unlocked window; it is confined to deployments that actually mount SMB shares with multichannel from untrusted/attacker-influenced servers; and it requires client-side action to establish the session (UI:R). Hosts not using cifs.ko or not using multichannel are not exposed.

This is a client-side use-after-free race in the Linux kernel SMB/CIFS client (cifs_try_adding_channels()), triggered when a malicious or compromised SMB3 multichannel server flaps its advertised network interfaces while the client drops iface_lock during channel setup. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) and the real-world signals are consistent in pointing to LOW operational priority: EPSS is only 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit (POC) is referenced. The CVSS vector itself tempers the score with AC:H (a tight timing-dependent race) and UI:R, meaning exploitation is neither trivial nor automatable. The C:H/I:H/A:H impact rating is the typical worst-case theoretical treatment of any kernel UAF; the described primitive is specifically a READ of freed memory (iface->rdma_capable/is_active, iface_head.next), which realistically yields a crash or limited information leak rather than a reliably demonstrated write/RCE - the input tag 'Information Disclosure' aligns with the read-UAF nature. Net: a genuine kernel correctness bug worth patching in the normal cycle, but a high-CVSS/low-real-risk issue for most environments, not an emergency. Note the attacker must be the SMB server side and the client must have multichannel in use, further narrowing exposure.

A Linux host mounts an SMB3 share with multichannel in use from an attacker-controlled or compromised file server. The server rapidly re-advertises and withdraws network interfaces so that a concurrent interface refresh frees the 'niface' entry while cifs_try_adding_channels() has released iface_lock during cifs_ses_add_channel(), causing the iterator and loop body to dereference freed memory - crashing the client or leaking freed kernel data. No public exploit code is identified at time of analysis, and the race (AC:H) plus required client interaction (UI:R) make reliable triggering difficult.