https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:40:03 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97562 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: pin DFS superblock in iterator callback</p> <p>tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it.</p> <p>A deterministic KASAN test reproduces the race as:</p> <p>BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80</p> <p>The same test passes with this change applied.</p> <p>Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: pin DFS superblock in iterator callback</p> <p>tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it.</p> <p>A deterministic KASAN test reproduces the race as:</p> <p>BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80</p> <p>The same test passes with this change applied.</p> <p>Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.</p> https://vulnerability.circl.lu/vuln/cve-2026-97562