Vulnerability-Lookup

GHSA-F559-3M6W-QCP7

Vulnerability from github – Published: 2026-10-06 09:31 – Updated: 2026-10-07 09:32

Details

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix rlist race and missing initialization

TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_empty() always return false and list_add() dereference a NULL ->prev pointer.

Also, cifs_signal_cifsd_for_reconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98174"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T09:17:59Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix rlist race and missing initialization\n\nTCP_Server_Info.rlist is allocated via kzalloc which zeros both -\u003enext\nand -\u003eprev to NULL instead of pointing to itself, making list_empty()\nalways return false and list_add() dereference a NULL -\u003eprev pointer.\n\nAlso, cifs_signal_cifsd_for_reconnect() can be called concurrently\nfrom multiple cifsd threads, allowing the same server\u0027s rlist node to\nbe added twice into the local list, corrupting it.",
  "id": "GHSA-f559-3m6w-qcp7",
  "modified": "2026-10-07T09:32:12Z",
  "published": "2026-10-06T09:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98174"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/04082b1833856cb9ed87e0d3d5f04cbf836cf7da"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a8f82f9c5839389cf4036029dd75a9911049e83"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b5f924ffbfa976e4b97f17e8132c595b97482c2d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-98174 (GCVE-0-2026-98174)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:44 – Updated: 2026-10-07 06:49

Title

smb: client: fix rlist race and missing initialization

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_empty() always return false and list_add() dereference a NULL ->prev pointer. Also, cifs_signal_cifsd_for_reconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 54/100 over 6633 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/b5f924ffbfa976e4b…
https://git.kernel.org/stable/c/5a8f82f9c5839389c…
https://git.kernel.org/stable/c/04082b1833856cb9e…
https://git.kernel.org/stable/c/c037d6bde3dd5fa00…
https://git.kernel.org/stable/c/5f270f091256da133…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b5f924ffbfa976e4b97f17e8132c595b97482c2d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5a8f82f9c5839389cf4036029dd75a9911049e83 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 04082b1833856cb9ed87e0d3d5f04cbf836cf7da (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5f270f091256da1338c3631083e15d7f83cc05e1 (git) Affected: 0 , < 6.6.158 (semver) Affected: 0 , < 6.12.112 (semver) Affected: 0 , < 6.18.54 (semver) Affected: 0 , < 7.2.8 (semver)
Linux	Linux	Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5f924ffbfa976e4b97f17e8132c595b97482c2d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5a8f82f9c5839389cf4036029dd75a9911049e83",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "04082b1833856cb9ed87e0d3d5f04cbf836cf7da",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5f270f091256da1338c3631083e15d7f83cc05e1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.158",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.112",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.54",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix rlist race and missing initialization\n\nTCP_Server_Info.rlist is allocated via kzalloc which zeros both -\u003enext\nand -\u003eprev to NULL instead of pointing to itself, making list_empty()\nalways return false and list_add() dereference a NULL -\u003eprev pointer.\n\nAlso, cifs_signal_cifsd_for_reconnect() can be called concurrently\nfrom multiple cifsd threads, allowing the same server\u0027s rlist node to\nbe added twice into the local list, corrupting it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The trigger is SMB transport data sent by the server: an unexpected RFC1002 frame type, or a framing or decrypt error, on two channels makes is_smb_response()/smb2ops call cifs_reconnect(server, true). That leads to __cifs_reconnect() -\u003e cifs_signal_cifsd_for_reconnect(all_channels=true) in two cifsd threads at once. The server\u0027s TCP traffic is routable.\nAC:H - The attacker must get the two channels\u0027 list_add(\u0026nserver-\u003erlist, \u0026reco) calls inside the short window after one thread drops cifs_tcp_ses_lock and before it finishes walking its on-stack reco list. Timing that from frames sent over the network is unreliable. The bug also needs a multichannel session (chan_count \u003e 1), and that is not the default.\nPR:N - A malicious SMB server, or an on-path attacker on the client\u0027s SMB connections, needs no account on the victim host. The reconnect is triggered by RFC1002 frames that cifsd parses before any check on the server\u0027s authenticity.\nUI:R - A victim has to mount a share from the attacker\u0027s server with the non-default multichannel or max_channels\u003e1 option. Otherwise ses-\u003echan_count stays 1 and the loop over chans[1..] in cifs_signal_cifsd_for_reconnect() never adds anything to reco.\nS:U - The corruption is in the CIFS client\u0027s TCP_Server_Info list linkage and other kernel stack frames, inside the same kernel security authority. No guest/host, IOMMU or sandbox boundary is crossed.\nC:H - One TCP_Server_Info.rlist node ends up linked into two cifsd threads\u0027 on-stack reco lists. list_for_each_entry_safe() can then follow a pointer into another thread\u0027s stack, which may already be dead, and treat it as a TCP_Server_Info. That is kernel memory corruption that can be steered into reads of controlled memory.\nI:H - The bogus entry is passed to set_need_reco() (spin_lock and a tcpStatus write) and to cifs_put_tcp_session() (srv_count decrement and possible teardown and free). Those are kernel writes through a corrupted list pointer, the same class as list-corruption write primitives.\nA:H - With CONFIG_LIST_HARDENED/DEBUG_LIST, the first list_del_init() on the doubly linked rlist BUGs. Without it, the walk faults or loops on the corrupted reco list. The server can resend bad frames after every reconnect, so it can keep retrying until the client host crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:49:23.401Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5f924ffbfa976e4b97f17e8132c595b97482c2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a8f82f9c5839389cf4036029dd75a9911049e83"
        },
        {
          "url": "https://git.kernel.org/stable/c/04082b1833856cb9ed87e0d3d5f04cbf836cf7da"
        },
        {
          "url": "https://git.kernel.org/stable/c/c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"
        }
      ],
      "title": "smb: client: fix rlist race and missing initialization",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98174",
    "datePublished": "2026-10-06T08:44:18.350Z",
    "dateReserved": "2026-09-25T10:25:14.322Z",
    "dateUpdated": "2026-10-07T06:49:23.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-F559-3M6W-QCP7

CVE-2026-98174 (GCVE-0-2026-98174)

Tags

Sightings

Nomenclature

Related by attack behaviour