CVE-2026-97562

Katalog CVE

CVSS 7.5 · High EPSS 0,41%

Skor CVSS 3.1 7.5 (High) menurut CNA.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.

Rincian

Terbit di NVD

25 September 2026

Terakhir diubah

3 Oktober 2026

Status NVD

Received

CVSS 3.1

7.5 (High), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/3c9acc9835c304013a4faeb969fe9333d66ca9f8
• https://git.kernel.org/stable/c/5b01a8c0209690db75341528ec53fd87e0ac1460
• https://git.kernel.org/stable/c/a6b6561522212af852c9ad8a7dca8d59ef2c7377
• https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818
• https://git.kernel.org/stable/c/ea43a15cea36dc5ddd832be5bddeac7dd804cbcf