Vulnerability-Lookup

CVE-2026-74608 (GCVE-0-2026-74608)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40

Title

smb: client: Fix use-after-free in cifs_try_adding_channels()

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory. Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/64d7584e62ac8cdc7…
https://git.kernel.org/stable/c/c292d4686f717c03e…
https://git.kernel.org/stable/c/47dfac48bce7198ad…
https://git.kernel.org/stable/c/1ffacbadc14530e55…
https://git.kernel.org/stable/c/1305eadc6a7d78a8d…
https://git.kernel.org/stable/c/4986410316b1ae0e6…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: cbc53148cc0946b72d62a3c53870cb22ce4ec284 , < 64d7584e62ac8cdc750455c5fdc6008fc2de4f06 (git) Affected: cff97d683a083b862a8bb24309e0f4d2d928128a , < c292d4686f717c03e5022fc4ae7c782f39a94915 (git) Affected: 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 , < 47dfac48bce7198ad4f1a388fc8c9491f878ac3b (git) Affected: 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 , < 1ffacbadc14530e55b8d86f7b917524f6a0fb891 (git) Affected: 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 , < 1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805 (git) Affected: 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 , < 4986410316b1ae0e63c6ce418e4eb196723626e7 (git) Affected: 22a6c5b3425f327e7f4c3606a72277dce82c7d83 (git) Affected: 6.1.78 , < 6.1.183 (semver) Affected: 6.6.17 , < 6.6.152 (semver) Affected: 6.7.5 , < 6.8 (semver)	guessed
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/sess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64d7584e62ac8cdc750455c5fdc6008fc2de4f06",
              "status": "affected",
              "version": "cbc53148cc0946b72d62a3c53870cb22ce4ec284",
              "versionType": "git"
            },
            {
              "lessThan": "c292d4686f717c03e5022fc4ae7c782f39a94915",
              "status": "affected",
              "version": "cff97d683a083b862a8bb24309e0f4d2d928128a",
              "versionType": "git"
            },
            {
              "lessThan": "47dfac48bce7198ad4f1a388fc8c9491f878ac3b",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "1ffacbadc14530e55b8d86f7b917524f6a0fb891",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "4986410316b1ae0e63c6ce418e4eb196723626e7",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22a6c5b3425f327e7f4c3606a72277dce82c7d83",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.183",
              "status": "affected",
              "version": "6.1.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.152",
              "status": "affected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/sess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "6.1.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_try_adding_channels()\n\ncifs_try_adding_channels() takes a temporary reference to an interface\nbefore dropping iface_lock. If cifs_ses_add_channel() fails, it drops\nthat reference and then increments iface-\u003eweight_fulfilled.\n\nA concurrent interface list refresh can remove the list reference while\nchannel creation is in progress. In that case, the failure-path\nkref_put() releases the last reference and frees iface. Updating\nweight_fulfilled afterward then accesses freed memory.\n\nIncrement weight_fulfilled before dropping the temporary reference,\nkeeping iface alive for the final access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the kernel SMB3 client multichannel path reached while handling remote SMB/CIFS server traffic (channel setup, reconnect, and FSCTL_QUERY_NETWORK_INTERFACE_INFO responses) over TCP, so a malicious or compromised SMB server can trigger it from the network.\nAC:L - A hostile SMB server can force cifs_ses_add_channel() to fail and concurrently drive interface-list refresh during the unlocked window; the attacker controls both sides of the race via reconnects, binding failures, and crafted interface responses with retries.\nPR:N - The attacker only needs to operate the malicious SMB server peer; no credentials, local shell access, or privileges on the victim host are required once the client has an SMB3 multichannel session to that server.\nUI:N - After an SMB3 multichannel mount exists, kernel delayed query_interfaces work, automatic reconnect on dropped TCP, and post-mount channel scaling invoke cifs_try_adding_channels() without further user action, letting the server trigger exploitation repeatedly.\nS:U - The UAF corrupts client kernel heap state within the same host kernel security authority and does not inherently cross a VM, container, or IOMMU security boundary.\nC:H - Writing to a freed cifs_server_iface slab object is a use-after-free; attacker-influenced heap grooming can reclaim the object and enable arbitrary kernel memory disclosure via corrupted or overlapping live allocations.\nI:H - The post-free weight_fulfilled increment is a kernel heap write after free that can corrupt adjacent slab objects and be leveraged into arbitrary write or control-flow hijacking through heap shaping.\nA:H - The use-after-free can cause KASAN-detectable slab corruption, kernel oops, or panic, and a malicious server can retrigger it by repeating failed channel opens with concurrent interface-list refresh on reconnect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:33.533Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06"
        },
        {
          "url": "https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915"
        },
        {
          "url": "https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891"
        },
        {
          "url": "https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805"
        },
        {
          "url": "https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7"
        }
      ],
      "title": "smb: client: Fix use-after-free in cifs_try_adding_channels()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74608",
    "datePublished": "2026-08-22T15:31:55.298Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:33.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74608",
      "date": "2026-08-27",
      "epss": "0.00477",
      "percentile": "0.39234"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:47:44.000Z",
      "cve": "CVE-2026-74608",
      "id": "msrc_CVE-2026-74608",
      "initial_release_date": "2026-08-24T01:04:21.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: Fix use-after-free in cifs_try_adding_channels()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74608.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74608\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:33.290\",\"lastModified\":\"2026-08-25T06:18:37.637\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: Fix use-after-free in cifs_try_adding_channels()\\n\\ncifs_try_adding_channels() takes a temporary reference to an interface\\nbefore dropping iface_lock. If cifs_ses_add_channel() fails, it drops\\nthat reference and then increments iface-\u003eweight_fulfilled.\\n\\nA concurrent interface list refresh can remove the list reference while\\nchannel creation is in progress. In that case, the failure-path\\nkref_put() releases the last reference and frees iface. Updating\\nweight_fulfilled afterward then accesses freed memory.\\n\\nIncrement weight_fulfilled before dropping the temporary reference,\\nkeeping iface alive for the final access.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/sess.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cbc53148cc0946b72d62a3c53870cb22ce4ec284\",\"lessThan\":\"64d7584e62ac8cdc750455c5fdc6008fc2de4f06\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cff97d683a083b862a8bb24309e0f4d2d928128a\",\"lessThan\":\"c292d4686f717c03e5022fc4ae7c782f39a94915\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6aac002bcfd554aff6d3ebb55e1660d078d70ab0\",\"lessThan\":\"47dfac48bce7198ad4f1a388fc8c9491f878ac3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6aac002bcfd554aff6d3ebb55e1660d078d70ab0\",\"lessThan\":\"1ffacbadc14530e55b8d86f7b917524f6a0fb891\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6aac002bcfd554aff6d3ebb55e1660d078d70ab0\",\"lessThan\":\"1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6aac002bcfd554aff6d3ebb55e1660d078d70ab0\",\"lessThan\":\"4986410316b1ae0e63c6ce418e4eb196723626e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"22a6c5b3425f327e7f4c3606a72277dce82c7d83\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.78\",\"lessThan\":\"6.1.183\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.17\",\"lessThan\":\"6.6.152\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.7.5\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/sess.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:50:42+00:00",
      "cve": "CVE-2026-74608",
      "id": "CVE-2026-74608",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: Fix use-after-free in cifs_try_adding_channels()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74608.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-74608

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-08-25 06:18

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/sess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64d7584e62ac8cdc750455c5fdc6008fc2de4f06",
              "status": "affected",
              "version": "cbc53148cc0946b72d62a3c53870cb22ce4ec284",
              "versionType": "git"
            },
            {
              "lessThan": "c292d4686f717c03e5022fc4ae7c782f39a94915",
              "status": "affected",
              "version": "cff97d683a083b862a8bb24309e0f4d2d928128a",
              "versionType": "git"
            },
            {
              "lessThan": "47dfac48bce7198ad4f1a388fc8c9491f878ac3b",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "1ffacbadc14530e55b8d86f7b917524f6a0fb891",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "lessThan": "4986410316b1ae0e63c6ce418e4eb196723626e7",
              "status": "affected",
              "version": "6aac002bcfd554aff6d3ebb55e1660d078d70ab0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22a6c5b3425f327e7f4c3606a72277dce82c7d83",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.183",
              "status": "affected",
              "version": "6.1.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.152",
              "status": "affected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/sess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_try_adding_channels()\n\ncifs_try_adding_channels() takes a temporary reference to an interface\nbefore dropping iface_lock. If cifs_ses_add_channel() fails, it drops\nthat reference and then increments iface-\u003eweight_fulfilled.\n\nA concurrent interface list refresh can remove the list reference while\nchannel creation is in progress. In that case, the failure-path\nkref_put() releases the last reference and frees iface. Updating\nweight_fulfilled afterward then accesses freed memory.\n\nIncrement weight_fulfilled before dropping the temporary reference,\nkeeping iface alive for the final access."
    }
  ],
  "id": "CVE-2026-74608",
  "lastModified": "2026-08-25T06:18:37.637",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-22T16:16:33.290",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-Q727-XF93-53J5

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free in cifs_try_adding_channels()

cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled.

A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.

Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74608"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:33Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_try_adding_channels()\n\ncifs_try_adding_channels() takes a temporary reference to an interface\nbefore dropping iface_lock. If cifs_ses_add_channel() fails, it drops\nthat reference and then increments iface-\u003eweight_fulfilled.\n\nA concurrent interface list refresh can remove the list reference while\nchannel creation is in progress. In that case, the failure-path\nkref_put() releases the last reference and frees iface. Updating\nweight_fulfilled afterward then accesses freed memory.\n\nIncrement weight_fulfilled before dropping the temporary reference,\nkeeping iface alive for the final access.",
  "id": "GHSA-q727-xf93-53j5",
  "modified": "2026-08-25T06:31:22Z",
  "published": "2026-08-22T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74608"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-74608

Vulnerability from csaf_microsoft - Published: 2026-08-24 01:04 - Updated: 2026-08-24 14:47

Summary

smb: client: Fix use-after-free in cifs_try_adding_channels()

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-74608

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-74608 smb: client: Fix use-after-free in cifs_try_adding_channels() - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74608.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "smb: client: Fix use-after-free in cifs_try_adding_channels()",
    "tracking": {
      "current_release_date": "2026-08-24T14:47:44.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.280Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-74608",
      "initial_release_date": "2026-08-24T01:04:21.000Z",
      "revision_history": [
        {
          "date": "2026-08-24T01:04:21.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-24T14:47:44.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74608",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-74608 smb: client: Fix use-after-free in cifs_try_adding_channels() - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74608.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-24T01:04:21.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "smb: client: Fix use-after-free in cifs_try_adding_channels()"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74608 (GCVE-0-2026-74608)

FKIE_CVE-2026-74608

GHSA-Q727-XF93-53J5

MSRC_CVE-2026-74608

Tags

Sightings

Nomenclature