Executive brief
A vulnerability in the Linux kernel's CIFS/SMB client could allow for system instability or unauthorized data access. The issue stems from improper internal locking mechanisms used when managing network file share connections. If exploited, this could lead to memory corruption or crashes, potentially impacting the availability and security of systems that mount remote SMB file shares.
Technical details
A vulnerability in the Linux kernel CIFS/SMB client (fs/smb/client) involves improper locking usage for 'tcon' (tree connection) fields. Historically, the kernel used a broad 'cifs_tcp_ses_lock' to protect various objects; however, more granular locks like 'tc_lock' were introduced but not consistently applied to all tcon field accesses. This oversight creates race conditions during operations such as directory caching, cancelled close handles, and DFS referrals. An attacker could potentially exploit these race conditions to cause a use-after-free or other memory corruption states. The fix involves replacing the legacy global lock with the granular 'tc_lock' in affected components like cached_dir.c and smb2misc.c.
Affected products
- Linux Linux kernel 6.0 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: advisory: Initial disclosure by kernel.org
- 2026-05-06: disclosed
- 2026-03-04: patched: Patches committed to stable trees
References
- https://git.kernel.org/stable/c/3969db6b22e3d90d8c5f22ac1a7fe0350a94c136
- https://git.kernel.org/stable/c/601dd3b79769b38d30b693c40afdb2a4b7edf9d0
- https://git.kernel.org/stable/c/8c59eeeeffa1524ef57e173a89a1a3ff539888d5
- https://git.kernel.org/stable/c/953953abb66e52c224057ab91e404284fefeab62
- https://git.kernel.org/stable/c/96c4af418586ee9a6aab61738644366426e05316