7.5

CVE-2026-97562

smb: client: pin DFS superblock in iterator callback

In the Linux kernel, the following vulnerability has been resolved:

smb: client: pin DFS superblock in iterator callback

tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super()
takes its active reference only after iterate_supers_type() has dropped
s_umount and its passive reference. Concurrent DFS automount expiry can
therefore free the superblock before cifs_sb_active() uses it.

A deterministic KASAN test reproduces the race as:

  BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80

The same test passes with this change applied.

Take the active reference in the callback while iterate_supers_type()
still holds s_umount shared. cifs_put_tcp_super() remains the matching
release.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version bacd704a95ad0b93af995aae4a523aa046f46563
Version < 3c9acc9835c304013a4faeb969fe9333d66ca9f8
Status affected
Version bacd704a95ad0b93af995aae4a523aa046f46563
Version < ea43a15cea36dc5ddd832be5bddeac7dd804cbcf
Status affected
Version bacd704a95ad0b93af995aae4a523aa046f46563
Version < a6b6561522212af852c9ad8a7dca8d59ef2c7377
Status affected
Version bacd704a95ad0b93af995aae4a523aa046f46563
Version < 5b01a8c0209690db75341528ec53fd87e0ac1460
Status affected
Version bacd704a95ad0b93af995aae4a523aa046f46563
Version < d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.7
Status affected
Version 0
Version < 5.7
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.53
Status unaffected
Version <= 7.2.*
Version 7.2.7
Status unaffected
Version <= *
Version 7.3-rc3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.324
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/ea43a15cea36dc5ddd832be5bddeac7dd804cbcf
https://git.kernel.org/stable/c/a6b6561522212af852c9ad8a7dca8d59ef2c7377
https://git.kernel.org/stable/c/5b01a8c0209690db75341528ec53fd87e0ac1460
https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818
https://git.kernel.org/stable/c/3c9acc9835c304013a4faeb969fe9333d66ca9f8