Linux Kernel EUVD-2026-93103

Exploitation requires the Linux client to have an active CIFS/SMB mount to an attacker-controlled or compromised SMB server, and the attacker must induce socket read failures that call cifs_reconnect() and queue server->reconnect delayed work at the exact moment the cifs_demultiplex_thread is exiting and running clean_demultiplex_info(). The decisive limiting factor is the race window (CVSS AC:H): the reconnect work must remain queued on cifsiod_wq after kfree_sensitive(server), so the bug only triggers on connection teardown concurrent with a pending reconnect - it is not reachable against a client that never mounts a hostile/unstable SMB share. Practically, an administrator action to mount the share (UI:R) and the cifs module being in use are also prerequisites.

Signals point consistently to a LOW real-world priority despite the 7.5 (HIGH) CVSS. The provided CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) is driven by AV:N and full CIA impact, but it is tempered by AC:H (a race condition - the demultiplex thread must exit while a reconnect delayed-work item is still queued) and UI:R (a client must first be connected to the attacker's SMB server). EPSS reinforces low urgency at 0.21% (10th percentile). There is NO CISA KEV listing and no public exploit identified, so this is not confirmed exploited. No SSVC decision data was supplied. A key tension: the input CVSS claims AV:N with PR:N/C:H/I:H, but the actual flaw is a client-side kernel use-after-free whose reliable outcome is a kernel crash (DoS); remote code execution from a race-window UAF is theoretically possible but unproven and hard - treat the C:H/I:H claim as optimistic rather than confirmed. Also note the 'Information Disclosure' tag does not match the described use-after-free (a crash/memory-corruption bug), and should be verified. Overall: a legitimate memory-safety fix worth patching through normal kernel update cadence, not an emergency.

An attacker operates or compromises an SMB/CIFS server that a Linux client has mounted a share from, then forces repeated disconnects to trigger cifs_reconnect() while the demultiplex thread is tearing down. If the teardown (clean_demultiplex_info) frees the server structure while a reconnect delayed-work item remains queued on cifsiod_wq, smb2_reconnect_server() later reads freed memory, crashing the kernel or corrupting memory. No public exploit code or proof-of-concept was identified at the time of analysis, and reliable exploitation depends on winning a narrow race (AC:H).