Executive brief
The Linux kernel's SMB client contains a use-after-free vulnerability in its Distributed File System (DFS) cache management. When the cache discards target entries, a stale pointer can remain in memory and be dereferenced later, potentially allowing an attacker to read or corrupt kernel memory and crash the system.
Technical details
The vulnerability is a use-after-free in the SMB client's DFS cache implementation (fs/smb/client/dfs_cache.c). When free_tgts() releases all cache_dfs_tgt structures in a cache entry's target list (ce->tlist), the ce->tgthint pointer—which tracks the last-accessed target—is left pointing to freed memory. Subsequent code that dereferences ce->tgthint without checking validity will trigger a use-after-free condition. The fix sets ce->tgthint to NULL after freeing the targets. No authentication or user interaction is required; the vulnerability can be triggered via network SMB requests to a vulnerable system with DFS caching enabled.
Affected products
- Linux Linux Kernel Linux 6.2 through 6.18, 5.x through 6.x, and other affected stable branches (patched as of 2026-09-14)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-09-14: patched: Patch committed by Greg Kroah-Hartman to stable kernel trees
- 2026-07-24: other: Fix authored by Fredric Cover