EUVD-2026-93102
GHSA-f559-3m6w-qcp7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessMount SMB share from attacker-controlled server
-
DeliveryInduce repeated connection drops
-
ExploitTrigger concurrent cifsd reconnect threads
-
ExecutionNULL deref / double list_add on rlist
-
ImpactKernel panic (denial of service)
Vulnerability Assessment
| Exploitation Conditions | Requires the target host to actively use the Linux kernel SMB/CIFS client (cifs.ko) with at least one mounted SMB share, and a reconnect event to occur against that server. Triggering the corruption needs the reconnect path to reach list_add() on the never-initialized rlist node, and the double-add corruption specifically requires cifs_signal_cifsd_for_reconnect() to be invoked concurrently by multiple cifsd threads (a race). Limiting factors: systems not using the kernel SMB client are unaffected; exploitation depends on winning a timing-sensitive race (AC:H) and on a reconnect being induced; practical impact is a kernel crash rather than code execution or data theft. |
| Impact | This is a Linux kernel SMB (cifs) client flaw combining a missing list-head initialization (rlist allocated via kzalloc leaves ->next/->prev NULL, so list_empty() misbehaves and list_add() dereferences a NULL ->prev) with a race when cifs_signal_cifsd_for_reconnect() runs concurrently across multiple cifsd threads, allowing the same rlist node to be added twice and corrupting the list. The input CVSS of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) rates full confidentiality AND integrity AND availability impact, but the described defect - a NULL pointer dereference and list corruption during reconnect - is fundamentally a crash/denial-of-service condition in kernel SMB client code; the C:H/I:H rating appears overstated relative to the described behavior and should be verified against the vendor commit. Corroborating signals point to low real-world urgency: EPSS is 0.18% (6th percentile), there is NO CISA KEV listing, and no public exploit is referenced. AC:H is consistent with the need to win a reconnect race across threads, and UI:R reflects that a host must actively use the kernel SMB client and mount a share. Net assessment: a legitimate correctness/stability bug worth patching on SMB-client hosts, but not a drop-everything priority - low exploitation probability, no known active exploitation, and the practical impact is kernel instability (DoS) rather than the data compromise the input CVSS triple-H suggests. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | A host that mounts an SMB/CIFS share from an attacker-influenced or unreliable server experiences repeated connection drops, driving multiple cifsd kernel threads to call cifs_signal_cifsd_for_reconnect() simultaneously; the uninitialized rlist node is then added to the reconnect list, dereferencing a NULL ->prev or double-adding the node and corrupting the list. The result is a kernel NULL-pointer dereference / list corruption leading to a panic (denial of service). No public exploit code is referenced for this issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Kernel memory corruption and crash in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a missing list-head initialization in TCP_Server_Info.rlist combined with a race in cifs_signal_cifsd_for_reconnect(). Because rlist is allocated with kzalloc, its ->next and ->prev pointers are NULL rather than self-referential, so list_empty() always returns false and list_add() dereferences a NULL ->prev; concurrently, multiple cifsd threads can add the same server's rlist node twice, corrupting the list. Only systems actively using the kernel SMB/CIFS client with a mounted share and a reconnect event are affected; the authoritative assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. unauthenticated but requiring user interaction and a hard-to-win timing race, with impact limited to a kernel crash (denial of service) rather than code execution or data theft. EPSS is low at 0.18% (6th percentile), and no public exploit has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to Linux 6.6.158, 6.12.112, 6.18.54 or 7.2.8 (7.3-rc4 for the development line), or apply the corresponding stable commits linked from the references, notably https://git.kernel.org/stable/c/b5f924ffbfa976e4b97f17e8132c595b97482c2d, https://git.kernel.org/stable/c/5a8f82f9c5839389cf4036029dd75a9911049e83, https://git.kernel.org/stable/c/04082b1833856cb9ed87e0d3d5f04cbf836cf7da, https://git.kernel.org/stable/c/c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f and https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1; distribution kernels should be updated via the normal vendor errata channel, and reboot is required for the kernel fix to take effect, causing downtime on servers hosting SMB mounts. Where patching must be deferred, the most effective compensating control is to eliminate the exposed code path by not mounting SMB/CIFS shares through the in-kernel client on untrusted or unstable networks - either unmount active cifs mounts or move those workloads to a userspace SMB client (for example smbclient, gvfs or a FUSE-based client), accepting reduced performance, loss of kernel-level caching and altered mount semantics as the trade-off. Monitor and reduce reconnect churn (avoid network paths that repeatedly force reconnects against an SMB server), since exploitation requires reaching the reconnect path and winning a timing-sensitive race across cifsd threads; note that ACL-based network restrictions do not address this, as the flaw is triggered by the client's own reconnect handling rather than by a remote attacker's request.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This flaw lives in the Linux kernel's in-kernel SMB/CIFS client stack, affecting the TCP_Server_Info structure that tracks each mounted SMB server session. The rlist member is intended to be a self-initialized list head, but it is allocated with kzalloc, which zeroes memory: ->next and ->prev both become NULL instead of pointing to the head itself. This breaks the invariants of the kernel list API - list_empty() never reports the list as empty, and list_add() ends up dereferencing a NULL ->prev pointer. Compounding this, cifs_signal_cifsd_for_reconnect() can run concurrently from multiple cifsd threads, so the same rlist node may be inserted into the local list twice, producing classic double-add list corruption of the kind that leads to dangling pointers, infinite loops, or a kernel panic. The root-cause class is a race condition (TOCTOU-style concurrent list mutation) combined with use of uninitialized memory; no CWE is supplied in the source data. The affected CPE is cpe:2.3:a:linux:linux, and the fix commits are recorded in the kernel stable trees (b5f924ffbfa976e4b97f17e8132c595b97482c2d, 5a8f82f9c5839389cf4036029dd75a9911049e83, 04082b1833856cb9ed87e0d3d5f04cbf836cf7da, c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f, 5f270f091256da1338c3631083e15d7f83cc05e1). One feed tags the issue 'Information Disclosure', but the authoritative assessment and CVSS vector indicate availability impact only (C:N/I:N/A:H), so the practical consequence is a crash rather than data exposure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Triggered over the network via a malicious/unstable SMB server (AV:N) but needs a reconnect race (AC:H) and an active SMB mount (UI:R); the NULL deref/list corruption causes a kernel crash, so A:H with C:N/I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix rlist race and missing initialization
TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_empty() always return false and list_add() dereference a NULL ->prev pointer.
Also, cifs_signal_cifsd_for_reconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.
Executive ViewAI
A high-severity vulnerability in the Linux kernel's SMB/CIFS client (cifs.ko) can cause a kernel crash and denial of service on systems that actively mount remote SMB shares. Although the flaw is unauthenticated, exploitation requires user interaction and a difficult timing race, and no public exploit identified at time of analysis. A vendor patch is available, and leadership should prioritize patching affected systems to avoid potential file share outages.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB