Executive brief
A vulnerability was identified in the Linux kernel's SMB client component that could lead to a system crash or unpredictable behavior. The issue occurs when the system attempts to use network connection information that has already been deleted from memory. This typically happens during specific network file sharing operations involving multiple connections to the same server share.
Technical details
A use-after-free (UAF) vulnerability exists in fs/smb/client/cifs_swn.c within the Linux kernel. The function cifs_swn_notify() retrieves a witness registration by ID but fails to maintain a proper lifetime reference to the associated 'tcon' (tree connection) pointer after dropping the cifs_swnreg_idr_mutex. If a second mount for the same share exists, the registration may persist while the original tcon is freed, leading to a UAF when the notification path later attempts to access the freed pointer. The fix involves refactoring the registration to store stable identity strings (net name, share name) and dynamically pinning a live tcon at the time of notification.
Affected products
- Linux Linux Kernel fed979a7e082bd9f25f9002c3c4f8740dacd0bc8
Timeline
- 2026-07-25: disclosed
- 2026-07-18: patched: Mainline kernel patch applied
References
- https://git.kernel.org/stable/c/0700f946659d0ab2352ec8a9b1c6fc74b13a27d7
- https://git.kernel.org/stable/c/51d18db392e5386a7bb9e816d611f14e600cca3c
- https://git.kernel.org/stable/c/91b8a58c6ac15c7db6518f696389933282f88da7
- https://git.kernel.org/stable/c/945b4a4a54497db1dcb2f20ef801a84e884dac21
- https://git.kernel.org/stable/c/aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd
- https://git.kernel.org/stable/c/ec457f9afe5ae9538bdcd58fd4cb442b9787e183