Linux Kernel EUVD-2026-93189

Requires the Linux CIFS client (cifs.ko) to establish an SMB multichannel session against a server the attacker controls or has compromised, and the server must then signal that a secondary channel is no longer supported - the exact path that leads cifs_chan_skip_or_disable() to drop the channel reference via cifs_put_tcp_session() and then dereference the freed server/primary_server pointers. Limiting factors: the victim must initiate the mount (the attacker cannot reach the client unsolicited), SMB multichannel must be in use, and the use-after-free depends on a race/teardown timing window (reflected as AC:H), making reliable exploitation beyond a kernel crash difficult.

Signals conflict, and the net real-world risk is lower than the 8.1 base score suggests. The CVSS vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) scores High, but the AC:H flag is doing heavy lifting: this is a race-condition use-after-free in the Linux CIFS client that can only be triggered by an SMB server the victim has connected to, under a specific multichannel teardown sequence. EPSS corroborates low practical risk at 0.18% (6th percentile), there is no CISA KEV listing (exploitation status: no public exploit identified at time of analysis), and no public exploit code is referenced. The only authoritative signals present are the NVD/kernel.org patch commits and the CVSS vector; no SSVC decision data (automatable, exploitation, technical-impact) was supplied, so the SSVC framework cannot be applied. Note also that the C:H/I:H impacts are the theoretical worst case for a kernel UAF - the realistic primary outcome is a kernel crash (DoS) with a harder path to disclosure or code execution. The 'Information Disclosure' tag is plausible (reading freed memory via the stale primary_server pointer) but not the dominant impact. This is a legitimate fix to apply via normal kernel patching cadence, not an emergency.

An attacker who controls or has compromised an SMB/CIFS server waits for a Linux client to mount a share using SMB multichannel. The malicious server signals that a secondary channel is no longer supported, driving the client into cifs_chan_skip_or_disable() where the server structure is freed and then dereferenced, causing a kernel use-after-free. No public exploit code is identified; the AC:H rating reflects the narrow race window required to turn the crash into anything beyond denial of service.